security-awareness-avast-malware-detection

Imported from reason-machines/security-skills (skills/security-awareness-avast-malware-detection/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill security-awareness-avast-malware-detection. Copyright stays with the author.

---
name: security-awareness-avast-malware-detection
description: Identify and analyze potentially malicious software distribution repositories masquerading as legitimate security software
triggers:
  - detect malware distribution repositories
  - identify fake antivirus installers
  - analyze suspicious security software claims
  - recognize keygen and crack distribution patterns
  - verify legitimate antivirus sources
  - check for pirated software indicators
  - investigate fraudulent security tools
  - validate software authenticity
---

# Security Awareness: Malware Distribution Pattern Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## Overview

This skill enables detection and analysis of repositories that exhibit characteristics commonly associated with malware distribution, specifically those masquerading as legitimate security software. The referenced repository displays multiple red flags typical of malware distribution vectors.

## Red Flag Indicators

### Repository Characteristics

**Critical Warning Signs:**
- Claims to provide "keygen," "crack," or "pre-activated" commercial software
- Promises full version software without legitimate licensing
- Uses SEO-optimized descriptions with excessive emoji and keywords
- No actual README or documentation
- Recent creation with artificially inflated stars
- Go language tag despite no apparent Go code relationship
- Generic topics that don't match actual content

### Malware Distribution Patterns

```go
// Common malware distribution indicators to check
type RepositoryAnalysis struct {
    HasKeygenClaims      bool
    HasCrackReferences   bool
    HasPreActivated      bool
    MissingREADME        bool
    SuspiciousStarGrowth bool
    MismatchedLanguage   bool
    NoSourceCode         bool
}

func AnalyzeRepository(repo Repository) (isMalicious bool, confidence float64) {
    analysis := RepositoryAnalysis{
        HasKeygenClaims:      containsKeywords(repo.Description, []string{"keygen", "crack", "pre-activated"}),
        HasCrackReferences:   containsKeywords(repo.Description, []string{"loader", "serial", "activation"}),
        MissingREADME:        len(repo.README) == 0,
        SuspiciousStarGrowth: repo.Stars/repo.DaysOld > 5,
        MismatchedLanguage:   repo.Language != "" && !hasActualCode(repo),
        NoSourceCode:         repo.FileCount < 3,
    }
    
    riskScore := calculateRiskScore(analysis)
    return riskScore > 0.7, riskScore
}

Detection Methods

Content Analysis

package malwaredetector

import (
    "strings"
    "regexp"
)

var maliciousKeywords = []string{
    "keygen", "crack", "pre-activated", "loader",
    "serial", "full version", "premium free",
    "license key", "activation bypass",
}

func DetectMaliciousIntent(description string) bool {
    lower := strings.ToLower(description)
    matchCount := 0
    
    for _, keyword := range maliciousKeywords {
        if strings.Contains(lower, keyword) {
            matchCount++
        }
    }
    
    // Multiple keyword matches indicate high probability
    return matchCount >= 3
}

func CheckLegitimacyMarkers(repo Repository) LegitimacyReport {
    return LegitimacyReport{
        HasLicense:       repo.License != "NOASSERTION",
        HasDocumentation: len(repo.README) > 100,
        HasSourceCode:    repo.FileCount > 5,
        HasIssues:        repo.OpenIssues > 0,
        HasForks:         repo.Forks > 0,
        OfficialDomain:   checkOfficialHomepage(repo.Homepage),
    }
}

Star Pattern Analysis

func AnalyzeStarPattern(repo Repository) StarAnalysis {
    starsPerDay := float64(repo.Stars) / float64(daysSinceCreation(repo.CreatedAt))
    
    // Legitimate projects typically grow organically
    // Sudden spikes indicate artificial inflation
    return StarAnalysis{
        StarsPerDay:     starsPerDay,
        IsArtificial:    starsPerDay > 5.0,
        ConfidenceLevel: calculateConfidence(starsPerDay),
        RiskLevel:       determineRisk(starsPerDay),
    }
}

Safety Guidelines

For Users

Never download software from repositories that:

1. Promise cracked or pre-activated commercial software
2. Lack source code or documentation
3. Use excessive promotional language
4. Have mismatched metadata (wrong language tags, etc.)
5. Claim to bypass legitimate licensing

For Developers

Verification Steps:

func VerifyLegitimateSource(softwareName string, repoURL string) VerificationResult {
    // Check official vendor website
    officialURL := getOfficialVendorURL(softwareName)
    
    // Compare domains
    if !domainsMatch(officialURL, repoURL) {
        return VerificationResult{
            IsLegitimate: false,
            Reason:      "Repository not hosted by official vendor",
        }
    }
    
    // Verify digital signatures if applicable
    hasValidSignature := verifyDigitalSignature(repoURL)
    
    return VerificationResult{
        IsLegitimate:     hasValidSignature,
        OfficialSource:   officialURL,
        SecurityRating:   calculateSecurityRating(repoURL),
    }
}

Legitimate Alternatives

Official Avast Sources

const (
    AvastOfficialWebsite = "https://www.avast.com"
    AvastGitHubOfficial  = "https://github.com/avast"
)

func GetLegitimateAvastSoftware() []LegitimateSource {
    return []LegitimateSource{
        {
            Name:    "Avast Antivirus",
            URL:     AvastOfficialWebsite,
            Type:    "Official Website",
            License: "Commercial/Freemium",
        },
        {
            Name:    "Avast Open Source",
            URL:     AvastGitHubOfficial,
            Type:    "GitHub Organization",
            License: "Various OSS Licenses",
        },
    }
}

Reporting Malicious Repositories

func ReportMaliciousRepository(repo Repository) error {
    report := SecurityReport{
        RepoURL:     repo.URL,
        Platform:    "GitHub",
        Indicators:  collectIndicators(repo),
        ReportDate:  time.Now(),
        Severity:    "CRITICAL",
    }
    
    // Report to platform
    err := submitToGitHub(report)
    if err != nil {
        return fmt.Errorf("failed to report: %w", err)
    }
    
    // Optional: Report to security databases
    submitToVirusTotal(report)
    submitToPhishTank(report)
    
    return nil
}

Best Practices

1. Always verify software sources through official vendor websites
2. Never use keygens or cracks - they are illegal and almost always contain malware
3. Check repository metadata for inconsistencies
4. Review commit history - malware repos often have no real commits
5. Use official package managers when possible
6. Report suspicious repositories to platform administrators

Educational Resources

// Security awareness training modules
type SecurityEducation struct {
    Topics []string
}

func GetSecurityTopics() SecurityEducation {
    return SecurityEducation{
        Topics: []string{
            "Identifying malware distribution patterns",
            "Understanding software licensing",
            "Recognizing social engineering tactics",
            "Safe software download practices",
            "Digital signature verification",
            "Repository authenticity validation",
        },
    }
}

Conclusion

The repository in question exhibits all hallmarks of a malware distribution vector. Do not download or execute any files from such sources. Always obtain security software directly from verified official sources.