Spot malware hiding in fake software repositories.
Guides users in recognizing malware-distribution patterns and documenting them for threat intelligence without running suspicious binaries.
When to use it
Use when investigating suspicious repositories, fake software distribution, or malware-delivery campaigns.
Give it a suspicious repository or a malware-distribution question; it returns an analysis of warning signs and guidance for safe investigation.
The demonstrated isolation setup requires Docker to start a network-disabled container with the samples mounted read-only.
An environment variable supplies the API key for the conditional VirusTotal hash lookup; the example skips that lookup when the key is absent.
This skill
GitHub
Reports malicious repositories to GitHub (irreversible)
VirusTotal
Checks file hashes with VirusTotal