wwumitwwumit/skills-tools/skills/malware-scan/SKILL.md

malware-scan

Skill0 starsChanged 3 months agoMITView on GitHub

恶意代码静态检测器。扫描插件/技能代码中的恶意模式与危险调用链：远程代码执行（curl|sh）、混淆执行（base64/hex 解码后 eval/exec）、可疑数据外传、持久化痕迹（写 rc/crontab/自启动）、凭据读取（~/.ssh/.env/API key）。纯本地静态分析（不执行代码）、零第三方依赖、输出 JSON 报告。 Use when: 用户要在安装/发布前检查插件/技能代码是否有恶意或危险模式，或询问代码安全扫描。 Trigger: malware-scan, 恶意代码, 代码扫描, 安全扫描, 后门, 危险调用

Pipes a download into a shell
Reads credentials

2 other projects use a version of this.

Adopted by

Most recently taken up by

evanpersinger/claude-skillstheir own version, first seen Aug 16, 2026
dennisonbertram/claude-mac-guardiantheir own version, first seen Apr 20, 2026

Other versions2 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 2
dennisonbertram/claude-mac-guardian★ 1same name
evanpersinger/claude-skills★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository12 other files it gives its agents.
- bundle-lintSkill
- csv-toolsSkill
- dependency-scanSkill
- excel2insights-proSkill
- excel2insightsSkill
- expert2skillSkill
- finance-toolsSkill
- fitness-dailySkill
- runtime-probeSkill
- skill-complianceSkill
- study-abroad-assistantSkill
- sum2slides-proSkill

The file

Create a free account to mount

Files

SKILL.md

🔍 Malware Scan — 恶意代码静态检测器

Overview

发布/安装前对插件或技能代码做静态恶意检测（不执行代码）：

MAL-001 远程代码执行：curl|sh / wget|sh / eval(open().read())
MAL-002 混淆执行：base64/hex 解码后 eval/exec/subprocess
MAL-003 可疑数据外传：网络调用（端点清单供与披露核对）
MAL-004 持久化痕迹：写 shell rc / crontab / launchd / systemd / 自启动
MAL-005 凭据读取：读 ~/.ssh / .aws / .env / API key 文件
MAL-006 危险调用链：subprocess/exec 与网络/写文件同文件组合

Usage

python3 scripts/malware-scan.py --dir <插件目录> --format json        # 静态检测
python3 scripts/malware-scan.py --dir <插件目录> --online --format json  # + OSV 依赖恶意包（MAL）

输出（JSON）

{
  "scanner": "malware-scan@1.0.0",
  "issues": [
    { "rule": "MAL-001", "severity": "high", "file": "scripts/x.sh", "line": 3, "found": "curl -s ... | sh" }
  ],
  "score": 90
}

安全说明

纯静态分析：不执行代码、不联网、零第三方依赖
内置静态模式基线随包分发；动态威胁情报（新恶意样本库）需生态级后端规则库（版本化 + fail-closed），远期共建
静态扫描是提示性工具：命中模式需人工复核上下文（误报可能），不替代完整安全审计

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free