[Q&A] - buywhere-product-catalog trojan?

[AndreBezBirolo]

What kind of help do you need?

Repo structure or contribution flow

Your question

I downloaded the repository to my machine, and my Kaspersky Premium detected the buywhere-product-catalog file as a Trojan.

Environment and context

No response

What have you already tried?

Hoje, 20/08/2026 09:01:32;
Download negado;
Firefox;
firefox.exe;
C:\Program Files\Mozilla Firefox\firefox.exe;
C:\Program Files\Mozilla Firefox;
25376;
DESKTOPANDRE\andre;
Iniciador;
Bloqueado;
Bloqueado;HEUR:Trojan.ANSI.Skibadur.genw;
Cavalo de Troia;
Alto;
Exatamente;
https://github.com/sickn33/agentic-awesome-skills/blob/main/skills/buywhere-product-catalog/SKILL.md;
SKILL.md;
https://github.com/sickn33/agentic-awesome-skills/blob/main/skills/buywhere-product-catalog;
Arquivo;
Análise especializada

Before posting

• I checked the README, FAQ, and relevant docs first.

[sickn33]

Thanks for reporting this — I checked the exact object currently on main, not just the filename or rendered GitHub page.

I found no Trojan payload in skills/buywhere-product-catalog/SKILL.md. The directory contains only that single file. It is a 4,427-byte UTF-8 Markdown document: no executable or binary content, no scripts, no ANSI escape sequences or hidden control characters, and no bundled assets. Its two fenced examples are explicitly inert text examples. The repository's documentation-security scan also passes.

Current identifiers:

• Git blob: f868b69c41aca1cb39a4fc3ffc6411fe53d0f120
• SHA-256: 9fe27450068f341f2ab595aaf0616ae493e1c672136940aabe5d969b07cebc52

The file has not changed since verified merge commit dfd7405 on May 4, 2026.

Given the exact bytes and the generic HEUR: verdict, this is consistent with a Kaspersky heuristic false positive, not evidence of an actual Trojan in this repository. I would still not recommend disabling Kaspersky or adding a broad exclusion. Please update the Kaspersky databases, rescan, and submit the raw file or URL to Kaspersky OpenTIP for reanalysis.

If it still triggers, please share the SHA-256 and the exported Kaspersky report. If your hash differs from the value above, we will investigate that specific object.