MCPInstall

security-threat-awareness

by reason-machinesSecurity

Recognize and warn against malicious software distribution repositories masquerading as legitimate security tools

Installs
1K
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/reason-machines/security-skills --skill security-threat-awareness
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads security-threat-awareness automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Security Threat Awareness

Skill by ara.so — Security Skills collection.

⚠️ CRITICAL SECURITY WARNING

This repository is a malicious threat distribution channel, NOT legitimate software.

The project viceofficialtower74/Avast-Premium-Security-Windows-Latest exhibits multiple red flags indicating it is a malware distribution platform:

Threat Indicators

  1. Pirated Software Distribution: Offers "cracked" commercial software with "keygen," "activation," and "pre-activated license keys"
  2. Copyright Violation: Unauthorized distribution of Avast premium software
  3. Star Manipulation: Artificial engagement (68 stars at 5 stars/day) suggesting bot activity
  4. Misleading Content: No actual source code or README, only download links
  5. Trust Exploitation: Impersonates legitimate security software to lower user vigilance

Common Payloads in Such Repositories

  • Trojans: Remote access tools (RATs) for system control
  • Infostealers: Credential harvesting malware
  • Ransomware: Data encryption with ransom demands
  • Cryptominers: Unauthorized cryptocurrency mining
  • Botnet Agents: Enrolling systems into DDoS networks

What You Should Do Instead

For Legitimate Avast Software

# Visit official sources ONLY
# Official website: https://www.avast.com/
# Official download: https://www.avast.com/en-us/download-thank-you.php

# NEVER download security software from:
# - Unofficial GitHub repositories
# - File sharing sites
# - Torrent platforms
# - "Free premium" offers

For Open Source Antivirus Alternatives

# ClamAV (legitimate open source antivirus)
git clone https://github.com/Cisco-Talos/clamav.git
cd clamav
mkdir build && cd build
cmake ..
cmake --build .
sudo cmake --build . --target install

# Update virus definitions
sudo freshclam

Verify Repository Legitimacy

# Indicators to check before trusting a repository
def is_repository_suspicious(repo_data):
    """
    Evaluate repository for malware distribution indicators
    """
    red_flags = []
    
    # Check for piracy keywords
    piracy_terms = ['crack', 'keygen', 'license key', 'pre-activated', 
                    'full version', 'premium loader', 'serial']
    description_lower = repo_data['description'].lower()
    
    if any(term in description_lower for term in piracy_terms):
        red_flags.append("Contains piracy-related terms")
    
    # Commercial software in unofficial repo
    if 'avast' in description_lower or 'norton' in description_lower:
        if not repo_data['owner'].endswith('-official'):
            red_flags.append("Unofficial distribution of commercial software")
    
    # Suspicious engagement patterns
    stars_per_day = repo_data['stars'] / repo_data['age_days']
    if stars_per_day > 3:
        red_flags.append(f"Unnatural star growth: {stars_per_day:.1f}/day")
    
    # Missing source code
    if not repo_data['has_readme'] and repo_data['language'] == 'C++':
        red_flags.append("No README with claimed C++ project")
    
    return red_flags

# Example usage
repo_check = {
    'description': 'Avast Premium Security keygen activation',
    'owner': 'randomuser123',
    'stars': 68,
    'age_days': 12,
    'has_readme': False,
    'language': 'C++'
}

warnings = is_repository_suspicious(repo_check)
for warning in warnings:
    print(f"⚠️  {warning}")

Safe Software Acquisition Practices

Verification Checklist

before_downloading:
  - verify_official_source: true
  - check_digital_signature: true
  - review_repository_owner: "Is this the legitimate vendor?"
  - inspect_commit_history: "Real development or just uploads?"
  - read_community_feedback: "Check issues/discussions for warnings"
  - scan_with_virustotal: "Before executing anything"
  
never_trust:
  - repositories_offering_cracks: true
  - pre_activated_commercial_software: true
  - keygens_or_license_generators: true
  - suspiciously_high_star_counts: true
  - repos_with_no_source_code: true

Environment Protection

#!/bin/bash
# If you accidentally cloned a suspicious repository

# DO NOT execute any files
# DO NOT run setup.exe, install.bat, or similar

# Safely remove the repository
cd ..
rm -rf suspicious-repo-name

# Scan your system
# On Linux/macOS
sudo freshclam  # Update ClamAV definitions
sudo clamscan -r /path/to/downloads --remove

# On Windows (use Windows Defender)
# Start-MpScan -ScanType FullScan

Reporting Malicious Repositories

# Report to GitHub
# Visit: https://github.com/contact/report-abuse
# Select: "Malware distribution"
# Provide: Repository URL and evidence

# Report to antivirus vendors
# Avast: https://www.avast.com/report-malicious-file
# VirusTotal: https://www.virustotal.com/

Educational Resources

For legitimate security research and development:

Summary

DO NOT use, download, or interact with repositories offering:

  • Cracked commercial software
  • License key generators
  • Pre-activated premium versions
  • "Free" versions of paid security tools

ALWAYS obtain software from official vendor websites or verified open source projects with transparent development history.

FAQ

What does the security-threat-awareness skill do?

Recognize and warn against malicious software distribution repositories masquerading as legitimate security tools

How do I install security-threat-awareness?

Run npx skills add https://github.com/reason-machines/security-skills --skill security-threat-awareness in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-threat-awareness/ (personal) or .claude/skills/security-threat-awareness/ (project).

Which AI agents can use security-threat-awareness?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is security-threat-awareness safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains security-threat-awareness?

It is published by reason-machines in reason-machines/security-skills. It has 1,005 recorded installs.

More from reason-machines/security-skills

View all →

anthropic-cybersecurity-skills

reason-machines/security-skills

Use 754 structured cybersecurity skills mapped to MITRE ATT&CK, NIST CSF, ATLAS, D3FEND, and NIST AI RMF for AI-driven security operations

AI & Agents1.7K installs

pentest-ai-agents

reason-machines/security-skills

Claude Code subagents for offensive security research, penetration testing planning, recon analysis, exploit research, detection engineering, and security reporting

Security1.4K installs

pentest-agents-bug-bounty-framework

reason-machines/security-skills

Autonomous bug bounty agent framework with 50 agents, hunt loops, exploit chains, MCP servers for platform integration and writeup search

Code Quality & Workflow1.3K installs

openosint-ai-osint-framework

reason-machines/security-skills

AI-powered OSINT agent with interactive REPL, MCP server, and CLI for email/username/domain/IP/phone investigation using 11 integrated tools

Backend & APIs1.2K installs

vibe-security-skill

reason-machines/security-skills

Agent skill that audits vibe-coded apps for common security vulnerabilities introduced by AI coding assistants

Security1.1K installs

openclaw-security-hardening

reason-machines/security-skills

Deploy and manage security hardening for high-privilege autonomous AI agents (OpenClaw) using zero-trust architecture and automated defense matrices

Security1.1K installs

Popular security skills

View category →

azure-compliance

microsoft/azure-skills

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

OfficialSecurity567K installs

minimal-run-and-audit

lllllllama/rigorpilot-skills

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

Security477.4K installs

seo-audit

coreyhaines31/marketingskills

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security238.7K installs

firebase-security-rules-auditor

firebase/agent-skills

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

OfficialSecurity139.1K installs

audit

pbakaus/impeccable

Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.

Security81.9K installs

competitors

coreyhaines31/marketingskills

When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.

Security79.3K installs