Is this a scam project? My Chrome browser detected a virus during download.

[yydeepfam]

Given the virus error, this is highly suspicious. Has anyone conducted an audit?

[mukul975]

Thanks for raising this — it’s a legitimate question that deserves a straight answer.

What you’re seeing is almost certainly a false positive, but here’s the full context:

The detection is Trojan:Script/Wacatac.H!ml. The H!ml suffix means this is a heuristic/machine-learning detection, not a signature match against known malware. Windows Defender frequently flags large ZIP archives containing Python scripts, PowerShell files, and security-related content with this detection — especially when the scripts reference offensive techniques, network operations, or system commands. This repo contains 754 Python skill scripts across 26 security domains, many covering exactly those topics. That’s by design.

You can verify this yourself:

1.	VirusTotal — upload the ZIP or paste the GitHub download URL. If only 1–2 engines flag it (typically Microsoft’s), it’s a false positive. If multiple reputable engines flag it, that changes the picture.
2.	Inspect the content directly — the repo is plain Markdown and Python. Clone it with git clone rather than downloading the ZIP, or browse the source on GitHub before downloading anything.
3.	Windows Defender false positives on GitHub ZIPs are well-documented for security-tool repos — searching “Wacatac.H!ml github false positive” returns hundreds of identical reports across unrelated projects.

That said — I’d encourage skepticism, not just reassurance. This repo contains scripts designed to teach AI agents offensive security techniques. Some of those scripts intentionally describe attack patterns, credential handling, and system manipulation. That’s the point of the project, not a sign of malware — but it means antivirus heuristics will fire on it, and you should understand what you’re downloading before using it in any sensitive environment. Read the scripts before running anything.

If anyone has done a formal audit or VirusTotal scan, please share results here.

[XenoCoreGiger31]

Check out XenoCoreGiger31/Local-Model

I'm literally building the exact same sort of thing except for through MCP_server MCP_agent – loop and I just recently committed the social engineering tool kit and next week I'll be updating with new commits until this agent can DREAM!

[XenoCoreGiger31]

I love this idea!