# Malware Game Cheat Detection

> Detect and analyze malicious game cheating software and trainer malware distributed as open source projects

- Skill: `aradotso/malware-game-cheat-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso/malware-game-cheat-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso/malware-game-cheat-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aradotso (https://skillmd.com/u/aradotso)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aradotso/malware-game-cheat-detection

---


# Malware Game Cheat Detection

> Skill by [ara.so](https://ara.so) — Devtools Skills collection.

## Overview

This skill helps identify **malicious game trainer and cheat software** disguised as legitimate open source projects. These repositories typically promise game enhancements (ESP, aimbot, god mode) but deliver malware, keyloggers, or ransomware.

**⚠️ CRITICAL WARNING**: The project `XFaltixX/MECCHA-CHAMELEON-Trainer-Client` exhibits classic malware distribution patterns.

## Common Malware Indicators

### Red Flags in Repository Structure

1. **External download links** instead of source code
2. **Password-protected archives** (obfuscation technique)
3. **"Run as Administrator"** requirement
4. **Executable files** instead of readable source code
5. **Unverifiable claims** ("undetected", "2026", inflated star counts)
6. **Suspicious domains** (netlify.app, discord CDN, file-sharing sites)
7. **Generic or stolen README templates**

### Analysis Pattern

```python
# Detection heuristics for malware trainer repositories
import re
from dataclasses import dataclass

@dataclass
class MalwareIndicators:
    external_download: bool = False
    password_protected: bool = False
    admin_required: bool = False
    executable_only: bool = False
    suspicious_domain: bool = False
    fake_metrics: bool = False
    
    def risk_score(self) -> int:
        """Calculate risk score (0-100)"""
        indicators = [
            self.external_download,
            self.password_protected,
            self.admin_required,
            self.executable_only,
            self.suspicious_domain,
            self.fake_metrics
        ]
        return sum(indicators) * 16  # 6 indicators × 16 ≈ 100

def analyze_readme(readme_content: str) -> MalwareIndicators:
    """Analyze README for malware patterns"""
    indicators = MalwareIndicators()
    
    # Check for external downloads
    external_patterns = [
        r'https?://[^\s]+\.(zip|rar|exe|7z)',
        r'download.*archive',
        r'mega\.nz|mediafire|anonfiles|discord\.com/attachments'
    ]
    indicators.external_download = any(
        re.search(p, readme_content, re.I) 
        for p in external_patterns
    )
    
    # Check for password protection
    indicators.password_protected = bool(
        re.search(r'password[:\s]+[`"']?\w+', readme_content, re.I)
    )
    
    # Check for admin requirement
    indicators.admin_required = bool(
        re.search(r'run as administrator', readme_content, re.I)
    )
    
    # Check for suspicious domains
    suspicious_domains = ['netlify.app', 'github.io', 'vercel.app']
    indicators.suspicious_domain = any(
        domain in readme_content.lower() 
        for domain in suspicious_domains
        if 'download' in readme_content.lower()
    )
    
    return indicators

# Example usage
readme = """
Download: https://skydock.netlify.app/trainer.zip
Password: trainer2026
Run as Administrator
"""

result = analyze_readme(readme)
print(f"Risk Score: {result.risk_score()}/100")
# Output: Risk Score: 64/100
```

## Detection Commands

### Repository Scanning

```python
# scan_repository.py
import os
import subprocess
from pathlib import Path

def scan_repository(repo_path: str) -> dict:
    """Scan repository for malware indicators"""
    results = {
        'has_source_code': False,
        'has_executables': False,
        'has_suspicious_files': False,
        'file_count': 0
    }
    
    path = Path(repo_path)
    
    # Check for actual source files
    source_extensions = {'.py', '.js', '.go', '.rs', '.cpp', '.c'}
    source_files = [
        f for f in path.rglob('*') 
        if f.suffix in source_extensions
    ]
    results['has_source_code'] = len(source_files) > 0
    
    # Check for executables
    exe_files = list(path.rglob('*.exe')) + list(path.rglob('*.dll'))
    results['has_executables'] = len(exe_files) > 0
    
    # Check for suspicious patterns
    suspicious = ['.scr', '.bat', '.vbs', '.ps1']
    results['has_suspicious_files'] = any(
        path.rglob(f'*{ext}') for ext in suspicious
    )
    
    results['file_count'] = len(list(path.rglob('*')))
    
    return results

# Scan example
repo_scan = scan_repository('./suspicious-trainer')
if repo_scan['has_executables'] and not repo_scan['has_source_code']:
    print("⚠️ WARNING: Executables without source code detected!")
```

### URL Safety Check

```python
# url_checker.py
import re
from typing import List
from urllib.parse import urlparse

MALICIOUS_PATTERNS = [
    r'discord\.com/attachments',
    r'cdn\.discord',
    r'anonfiles\.',
    r'mega\.nz',
    r'mediafire\.',
    r'wetransfer\.',
    r'file\.io',
]

SUSPICIOUS_TLDs = ['.tk', '.ml', '.ga', '.cf', '.gq', '.zip']

def check_url_safety(url: str) -> dict:
    """Check if URL is likely malicious"""
    parsed = urlparse(url)
    
    result = {
        'url': url,
        'is_suspicious': False,
        'reasons': []
    }
    
    # Check against known malicious patterns
    for pattern in MALICIOUS_PATTERNS:
        if re.search(pattern, url, re.I):
            result['is_suspicious'] = True
            result['reasons'].append(f"Matches pattern: {pattern}")
    
    # Check TLD
    domain = parsed.netloc.lower()
    if any(domain.endswith(tld) for tld in SUSPICIOUS_TLDs):
        result['is_suspicious'] = True
        result['reasons'].append("Suspicious TLD")
    
    # Check for file extensions in URL
    dangerous_exts = ['.exe', '.scr', '.bat', '.zip', '.rar']
    if any(url.lower().endswith(ext) for ext in dangerous_exts):
        result['is_suspicious'] = True
        result['reasons'].append("Direct executable/archive link")
    
    return result

# Example
url = "https://skydock.netlify.app/trainer-archive.zip"
safety = check_url_safety(url)
print(f"Suspicious: {safety['is_suspicious']}")
print(f"Reasons: {', '.join(safety['reasons'])}")
```

## Real-World Example Analysis

### MECCHA-CHAMELEON-Trainer-Client Analysis

```python
# analyze_meccha_trainer.py
from datetime import datetime

def analyze_repository_metadata(repo_data: dict) -> dict:
    """Analyze repository metadata for fake/inflated metrics"""
    
    created = datetime.fromisoformat(repo_data['created_at'].replace('Z', '+00:00'))
    updated = datetime.fromisoformat(repo_data['updated_at'].replace('Z', '+00:00'))
    
    age_days = (updated - created).days
    stars = repo_data['stars']
    stars_per_day = stars / age_days if age_days > 0 else 0
    
    analysis = {
        'age_days': age_days,
        'stars_per_day': stars_per_day,
        'likely_fake': False,
        'warnings': []
    }
    
    # New repo with high star velocity = suspicious
    if age_days < 7 and stars_per_day > 50:
        analysis['likely_fake'] = True
        analysis['warnings'].append(
            f"Unnaturally high star velocity: {stars_per_day:.0f} stars/day"
        )
    
    # Future dates = obviously fake
    now = datetime.now(created.tzinfo)
    if created > now:
        analysis['likely_fake'] = True
        analysis['warnings'].append("Created date is in the future!")
    
    # Zero forks/issues but high stars = fake engagement
    if stars > 100 and repo_data['forks'] == 0:
        analysis['likely_fake'] = True
        analysis['warnings'].append("High stars but zero forks (fake engagement)")
    
    return analysis

# Analyze the MECCHA trainer
repo_metadata = {
    "created_at": "2026-06-28T07:17:40Z",  # FUTURE DATE!
    "updated_at": "2026-06-29T15:29:59Z",
    "stars": 185,
    "forks": 0,
    "open_issues": 0
}

result = analyze_repository_metadata(repo_metadata)
print(f"Likely Fake: {result['likely_fake']}")
for warning in result['warnings']:
    print(f"⚠️ {warning}")
```

## Safe Alternative Detection

```python
# legitimate_checker.py
def is_legitimate_game_mod(repo_path: str) -> bool:
    """Check if game modification tool is legitimate"""
    
    legitimacy_checks = {
        'has_readable_source': False,
        'uses_known_libraries': False,
        'has_documentation': False,
        'no_external_downloads': False,
        'community_verified': False
    }
    
    # Check for actual Python/JS/etc source files
    import os
    source_files = [
        f for f in os.listdir(repo_path)
        if f.endswith(('.py', '.js', '.ts', '.go'))
    ]
    legitimacy_checks['has_readable_source'] = len(source_files) > 0
    
    # Check if it uses legitimate libraries
    if os.path.exists(f"{repo_path}/requirements.txt"):
        with open(f"{repo_path}/requirements.txt") as f:
            deps = f.read()
            known_safe = ['pygame', 'pynput', 'requests']
            legitimacy_checks['uses_known_libraries'] = any(
                lib in deps for lib in known_safe
            )
    
    # Legitimate mods have real documentation
    docs = ['README.md', 'CONTRIBUTING.md', 'docs/']
    legitimacy_checks['has_documentation'] = any(
        os.path.exists(f"{repo_path}/{doc}") for doc in docs
    )
    
    return sum(legitimacy_checks.values()) >= 3
```

## Reporting Malware

### GitHub Abuse Report

```bash
# Report malicious repository
# Visit: https://github.com/contact/report-abuse

# Include:
# 1. Repository URL
# 2. Evidence of malware (external download links)
# 3. Type: "Malware distribution"
```

### Automated Reporting Script

```python
# report_malware.py
import os
import json

def generate_abuse_report(repo_url: str, evidence: dict) -> str:
    """Generate formatted abuse report"""
    
    report = f"""
MALWARE DISTRIBUTION REPORT

Repository: {repo_url}
Report Date: {evidence['date']}

EVIDENCE:
- External download link: {evidence.get('download_url', 'N/A')}
- Password-protected archive: {evidence.get('password', 'N/A')}
- Requires admin privileges: {evidence.get('admin_required', False)}
- No source code provided: {evidence.get('no_source', False)}

RISK ASSESSMENT:
{evidence.get('risk_assessment', 'High risk malware distribution')}

ADDITIONAL NOTES:
{evidence.get('notes', 'Repository disguised as game cheat tool')}
"""
    
    return report.strip()

# Example
evidence = {
    'date': '2024-01-15',
    'download_url': 'https://skydock.netlify.app/trainer-archive.zip',
    'password': 'trainer2026',
    'admin_required': True,
    'no_source': True,
    'risk_assessment': 'Confirmed malware distribution pattern',
    'notes': 'Future creation date (2026), fake stars, external download only'
}

report = generate_abuse_report(
    'https://github.com/XFaltixX/MECCHA-CHAMELEON-Trainer-Client',
    evidence
)
print(report)
```

## User Warning Message

```python
def warn_user_about_malware(repo_name: str, risk_score: int):
    """Display clear warning to user"""
    
    if risk_score > 50:
        print(f"""
╔══════════════════════════════════════════════════════════╗
║  ⚠️  MALWARE DETECTED - DO NOT DOWNLOAD  ⚠️              ║
╠══════════════════════════════════════════════════════════╣
║                                                          ║
║  Repository: {repo_name:<43} ║
║  Risk Score: {risk_score}/100                                     ║
║                                                          ║
║  This repository exhibits classic malware patterns:      ║
║  • External download links instead of source code        ║
║  • Password-protected archives (obfuscation)             ║
║  • Requires administrator privileges                     ║
║  • Fake engagement metrics                               ║
║                                                          ║
║  🚨 DO NOT:                                              ║
║  • Download any files from this repository               ║
║  • Run any executables                                   ║
║  • Enter passwords or credentials                        ║
║                                                          ║
║  ✅ Instead:                                             ║
║  • Report to GitHub: github.com/contact/report-abuse     ║
║  • Scan your system if you downloaded files              ║
║  • Use legitimate open-source alternatives               ║
║                                                          ║
╚══════════════════════════════════════════════════════════╝
        """)

# Usage
warn_user_about_malware("MECCHA-CHAMELEON-Trainer-Client", 85)
```

## Best Practices

1. **Never download** executables from repositories without visible source code
2. **Always verify** that claimed programming languages match actual files
3. **Check repository age** and star velocity for manipulation
4. **Scan with antivirus** if you've already downloaded suspicious files
5. **Report immediately** to GitHub abuse team
6. **Educate users** about malware distribution tactics

## Environmental Variables

```bash
# For automated scanning tools
export VIRUSTOTAL_API_KEY="your_vt_api_key_here"
export GITHUB_TOKEN="your_github_pat_here"
export ABUSE_REPORT_EMAIL="security@example.com"
```

## Summary

The `MECCHA-CHAMELEON-Trainer-Client` repository is **confirmed malware**. Key indicators:

- ✅ External download link (not source code)
- ✅ Password-protected archive
- ✅ Requires admin privileges  
- ✅ Future creation date (2026)
- ✅ Fake engagement metrics (185 stars, 0 forks)
- ✅ Suspicious domain (netlify.app)

**Risk Score: 100/100 - DO NOT DOWNLOAD**