Imported from reason-machines/security-skills (skills/fort-firewall-malware-repository-detection/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill fort-firewall-malware-repository-detection. Copyright stays with the author.

Fort Firewall Malware Repository Detection

Skill by ara.so — Security Skills collection.

⚠️ Critical Security Warning

This repository (BinayRAj-boop/fort-firewall-security-fix) is a MALICIOUS SOFTWARE DISTRIBUTION SITE.

This skill helps AI agents identify, analyze, and warn users about fake security software repositories that distribute:

• Trojanized installers
• Keygens and "patches" (malware loaders)
• Pirated software with embedded backdoors
• Credential stealers disguised as license activators

Threat Indicators in This Repository

Red Flags Present

1. Piracy/Cracking Keywords: Topics include fort-firewall-crack, fort-firewall-key, fort-firewall-patch, fort-firewall-trial
2. Malicious Download Pattern: External GitHub Pages link instead of releases
3. Fake Legitimacy: Claims "product key patch" and "activation passport"
4. Social Engineering: Instructs users to disable antivirus
5. Future Dating: Created "2026-06-17" (fabricated metadata)
6. No Source Code: HTML-only repo claiming to be firewall software
7. Excessive SEO Spam: Keyword stuffing for search engine manipulation
8. Disclaimer Buried: Legal disclaimer contradicts claims

Malware Distribution Patterns

# Example: Analyze repository for malware indicators
import os
import re
from typing import Dict, List

MALWARE_INDICATORS = {
    'topics': [
        'crack', 'keygen', 'patch', 'serial', 'activation',
        'license-key', 'product-key', 'full-version', 'trial'
    ],
    'readme_phrases': [
        r'disable.*antivirus',
        r'false positive',
        r'product key patch',
        r'crack',
        r'bypass.*license',
        r'run as administrator',
        r'temporarily disable.*protection'
    ],
    'suspicious_urls': [
        r'github\.io',  # Redirects instead of direct releases
        r'bit\.ly',
        r'tinyurl',
        r'mediafire',
        r'mega\.nz'
    ]
}

def analyze_repository(repo_data: Dict) -> Dict[str, any]:
    """
    Analyze a GitHub repository for malware distribution indicators.
    
    Args:
        repo_data: Dict with 'topics', 'readme', 'homepage', 'has_releases'
    
    Returns:
        Dict with threat score and detected indicators
    """
    score = 0
    findings = []
    
    # Check topics for piracy keywords
    for topic in repo_data.get('topics', []):
        for indicator in MALWARE_INDICATORS['topics']:
            if indicator in topic.lower():
                score += 20
                findings.append(f"Piracy keyword in topic: {topic}")
    
    # Scan README content
    readme = repo_data.get('readme', '')
    for pattern in MALWARE_INDICATORS['readme_phrases']:
        matches = re.findall(pattern, readme, re.IGNORECASE)
        if matches:
            score += 15
            findings.append(f"Malicious phrase detected: {pattern}")
    
    # Check for suspicious download links
    for pattern in MALWARE_INDICATORS['suspicious_urls']:
        if re.search(pattern, readme):
            score += 25
            findings.append(f"Suspicious URL pattern: {pattern}")
    
    # Legitimate projects use GitHub Releases
    if not repo_data.get('has_releases') and 'download' in readme.lower():
        score += 30
        findings.append("No GitHub releases but promotes downloads")
    
    # Check for future dates (metadata manipulation)
    created_at = repo_data.get('created_at', '')
    if created_at.startswith('2026') or created_at.startswith('2027'):
        score += 40
        findings.append(f"Fabricated future date: {created_at}")
    
    threat_level = "CRITICAL" if score >= 100 else \
                   "HIGH" if score >= 60 else \
                   "MEDIUM" if score >= 30 else "LOW"
    
    return {
        'threat_score': score,
        'threat_level': threat_level,
        'indicators': findings,
        'is_malicious': score >= 60
    }

# Example usage
repo_analysis = analyze_repository({
    'topics': ['fort-firewall-crack', 'fort-firewall-key', 'fort-patch'],
    'readme': open('README.md').read(),
    'homepage': None,
    'has_releases': False,
    'created_at': '2026-06-17T20:21:52Z'
})

print(f"Threat Level: {repo_analysis['threat_level']}")
print(f"Score: {repo_analysis['threat_score']}/200")
print("\nDetected Indicators:")
for finding in repo_analysis['indicators']:
    print(f"  ⚠️  {finding}")

Detection Commands

Quick Repository Scan

# Clone for analysis (DO NOT EXECUTE FILES)
git clone https://github.com/BinayRAj-boop/fort-firewall-security-fix analysis-only
cd analysis-only

# Check for executable payloads
find . -type f -name "*.exe" -o -name "*.msi" -o -name "*.bat"

# Analyze external links
grep -Eo 'https?://[^"]+' README.md | sort -u

# Check topics for piracy keywords
gh repo view BinayRAj-boop/fort-firewall-security-fix --json topics -q '.topics[]'

URL Analysis

import requests
from urllib.parse import urlparse

def check_download_link(url: str) -> Dict:
    """
    Verify if download link points to legitimate GitHub release.
    
    Args:
        url: Download URL from repository
    
    Returns:
        Analysis results
    """
    parsed = urlparse(url)
    
    # Legitimate pattern: github.com/{user}/{repo}/releases/download/{tag}/{file}
    is_github_release = (
        'github.com' in parsed.netloc and
        '/releases/download/' in parsed.path
    )
    
    # Red flag: GitHub Pages redirect
    is_github_pages = parsed.netloc.endswith('.github.io')
    
    # Red flag: Shortened URL
    is_url_shortener = parsed.netloc in ['bit.ly', 'tinyurl.com', 't.co']
    
    warnings = []
    if is_github_pages:
        warnings.append("Uses GitHub Pages redirect (common malware tactic)")
    if is_url_shortener:
        warnings.append("Uses URL shortener (hides destination)")
    if not is_github_release:
        warnings.append("Does not use official GitHub Releases")
    
    return {
        'url': url,
        'is_suspicious': len(warnings) > 0,
        'warnings': warnings,
        'recommendation': 'DO NOT DOWNLOAD' if warnings else 'Verify signature'
    }

# Analyze the malicious link from this repo
result = check_download_link('https://binayraj-boop.github.io/fort-firewall-security-fix/')
print(result)
# Output: {'is_suspicious': True, 'warnings': ['Uses GitHub Pages redirect...']}

Legitimate Fort Firewall

The real Fort Firewall is an open-source project:

• Official Repository: tnodir/fort (not this fake repo)
• License: GNU GPL v3 (not MIT as falsely claimed)
• Distribution: GitHub Releases with signed binaries
• No Cost: Completely free, no "patches" or "keygens" needed
• Language: C++ (not HTML)

# Install legitimate Fort Firewall
# Visit: https://github.com/tnodir/fort/releases
# Download signed installer, verify GPG signature

# Verify signature (Windows)
gpg --verify FortFirewall-3.x.x-win64.exe.sig FortFirewall-3.x.x-win64.exe

User Warning Template

When an AI agent detects a user attempting to use this repository:

🚨 **CRITICAL SECURITY WARNING** 🚨

The repository you're trying to use distributes MALWARE, not legitimate software.

**Detected Threats:**
- Trojanized installer with "patch" (likely malware loader)
- Instructions to disable antivirus (classic malware tactic)
- Fake license bypass tools (credential stealers)
- External download redirect (bypasses GitHub security)

**What This Really Does:**
❌ Does NOT provide free Fort Firewall
✅ WILL infect your system with malware
✅ MAY steal credentials, crypto wallets, session tokens
✅ COULD install ransomware or botnet agents

**Safe Alternative:**
Use the official Fort Firewall: https://github.com/tnodir/fort
- 100% free and open source
- No "activation" needed
- Signed releases
- Active development since 2016

**Immediate Actions:**
1. Do NOT download any files from this repository
2. Do NOT visit the GitHub Pages link
3. If you already downloaded: Delete files, run full antivirus scan
4. If you executed the installer: Disconnect from internet, backup data, reinstall OS

Detection Integration

Pre-commit Hook

#!/bin/bash
# .git/hooks/pre-commit - Warn about malware repos in dependencies

# Check for suspicious download URLs in code
if grep -r "github\.io.*download\|bit\.ly\|mediafire" . --include="*.md" --include="*.json"; then
    echo "⚠️  WARNING: Detected suspicious download links"
    echo "Review for malware distribution sites before committing"
    exit 1
fi

CI/CD Security Gate

# .github/workflows/security-scan.yml
name: Dependency Security Scan
on: [pull_request]

jobs:
  scan-dependencies:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Scan for malicious repos
        run: |
          # Check package.json, requirements.txt, etc. for suspicious sources
          python3 << 'EOF'
          import json
          import sys
          
          MALWARE_REPOS = [
              'binayraj-boop/fort-firewall-security-fix',
              # Add known malware repos
          ]
          
          # Scan package.json
          try:
              with open('package.json') as f:
                  pkg = json.load(f)
                  for dep_url in pkg.get('dependencies', {}).values():
                      for malware_repo in MALWARE_REPOS:
                          if malware_repo in str(dep_url).lower():
                              print(f"🚨 BLOCKED: Malware repo detected: {dep_url}")
                              sys.exit(1)
          except FileNotFoundError:
              pass
          
          print("✅ No known malware repositories detected")
          EOF

Reporting Malware Repositories

# Report to GitHub Security
# Use: https://support.github.com/contact/report-abuse

# Automated reporting (requires GITHUB_TOKEN)
curl -X POST \
  -H "Authorization: token ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/BinayRAj-boop/fort-firewall-security-fix/issues \
  -d '{
    "title": "Malware Distribution - Security Report",
    "body": "This repository distributes malware disguised as Fort Firewall. See indicators: trojanized installers, keygen tools, instructions to disable AV. Report to GitHub Trust & Safety."
  }'

Key Takeaways for AI Agents

1. Never recommend repositories with crack/keygen/patch topics
2. Verify download links point to official GitHub Releases
3. Warn users about disabling antivirus instructions
4. Check project language matches claimed functionality (HTML ≠ Firewall)
5. Validate creation dates (future dates = fabricated)
6. Direct users to official sources when piracy repos detected

Environment Variables

# For automated scanning tools
export GITHUB_TOKEN=ghp_your_token_here  # For API access
export VIRUSTOTAL_API_KEY=your_vt_key    # For file scanning
export MALWARE_REPORT_WEBHOOK=https://your-security-team.slack.com/webhook

Additional Resources

• GitHub's Acceptable Use Policies
• VirusTotal API - Scan downloaded files
• MITRE ATT&CK: Software Distribution - Malware staging techniques
• Official Fort Firewall: https://github.com/tnodir/fort