Agent skill

Defender Quickscan

by taracodlabs in taracodlabs/aiden

Windows Defender: scans, threat history, signatures (PowerShell)

Apache-2.0Auto-check passed

Install Defender Quickscan

skills CLI
$ npx skills add taracodlabs/aiden --skill defender-quickscan -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install taracodlabs/aiden defender-quickscan --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/defender-quickscan .claude/skills/defender-quickscan && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
defender-quickscan
GitHub stars
851
Token cost
~751 tokens
SKILL.md length
218 words
Files
2
Skills in repo
63
Repo updated
First seen
Licence
Apache-2.0

At a glance

Windows Defender: scans, threat history, signatures (PowerShell)

  • SKILL.md covers When to Use, How to Use, Examples and Cautions
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Defender Quickscan is an agent skill from taracodlabs/aiden. Windows Defender: scans, threat history, signatures (PowerShell)

Its SKILL.md is about 750 tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `skill.json`).

It works with PowerShell. The repository describes itself as: Aiden — an autonomous AI agent and work engine built solo. It can operate your browser, terminal, files, apps, APIs, skills and tools, remember context, recover from failures… The licence is Apache-2.0.

Example prompts

  • “Use the defender-quickscan skill to window Defender: scans, threat history, signatures (PowerShell)”
  • “/defender-quickscan”

What it can do on your machine

Read from SKILL.md and the folder at commit 3704204. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are powershell).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Defender Quickscan loads about 751 tokens when it runs. Until then it costs about 21 tokens; SKILL.md has 218 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~21
When it runs · the whole SKILL.md, loaded when a task matches
~751

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from taracodlabs/aiden at commit 3704204, republished under its Apache-2.0 licence (© taracodlabs). 218 words, ~751 tokens.

Download SKILL.mdSave it as .claude/skills/defender-quickscan/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
defender-quickscan
description
Windows Defender: scans, threat history, signatures (PowerShell)
category
windows
version
1.0.0
platform
windows
tags
defender, antivirus, security, scan, threat, malware, windows, powershell
license
Apache-2.0

Defender Quick Scan

Trigger Windows Defender antivirus scans, inspect threat history, update virus definitions, and check real-time protection status — all via PowerShell cmdlets.

When to Use

  • User wants to run a quick or full antivirus scan
  • User asks about recent threats detected by Defender
  • User wants to check if real-time protection is enabled
  • User needs to update virus/malware signatures
  • User wants to know the current Defender protection status

How to Use

Check Windows Defender status
powershell
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled,
  AntivirusEnabled, RealTimeProtectionEnabled,
  AntispywareSignatureAge, AntivirusSignatureAge, QuickScanAge
Run a quick or full scan
powershell
Start-MpScan -ScanType QuickScan   # fast scan of likely threat locations
Start-MpScan -ScanType FullScan    # thorough scan of all files (30-60 min)
Scan a specific file or folder
powershell
Start-MpScan -ScanType CustomScan -ScanPath "C:\Users\<you>\Downloads"
Update virus definitions
powershell
Update-MpSignature
View threat detection history
powershell
Get-MpThreatDetection | Select-Object ThreatID, ActionSuccess,
  DetectionSourceTypeID, Resources, InitialDetectionTime |
  Sort-Object InitialDetectionTime -Descending |
  Select-Object -First 10
View active threats
powershell
Get-MpThreat | Select-Object ThreatID, ThreatName, SeverityID,
  CategoryID, IsActive, Resources
Remove a detected threat
powershell
Remove-MpThreat -ThreatID 12345
Check exclusion list
powershell
(Get-MpPreference).ExclusionPath
(Get-MpPreference).ExclusionExtension
Add a scan exclusion (path)
powershell
Add-MpPreference -ExclusionPath "C:\DevTools\node_modules"

Examples

"Scan my Downloads folder for threats" → Start-MpScan -ScanType CustomScan -ScanPath "$env:USERPROFILE\Downloads" — Defender scans the folder and logs any detections.

"Are my virus definitions up to date?" → Get-MpComputerStatus | Select-Object AntivirusSignatureAge, AntivirusSignatureLastUpdated — signature age of 0 means updated today.

"Show me the last 5 threats Defender found" → Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 5

Cautions

  • Full scans can take 30-60 minutes and consume significant CPU/IO — warn the user before running
  • Start-MpScan requires Windows Defender to be the active antivirus — third-party AV may disable these cmdlets
  • Removing a threat with Remove-MpThreat is permanent; confirm with the user before executing
  • Adding exclusions reduces protection coverage — only exclude paths you're certain are safe

© taracodlabs, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/defender-quickscan of taracodlabs/aiden.

  • SKILL.md
  • skill.json

Open the folder on GitHubat commit 3704204

Compare with similar skills

Defender Quickscan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Defender Quickscan compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Defender Quickscan this skilltaracodlabs/aiden851—~751Automated safety check: PassApache-2.0
Pester Failure AnalysisPowerShell/PowerShell56k—~5.1kAutomated safety check: PassMIT
Copilot Session Failure Analysisdotnet/maui23k—~3.4kAutomated safety check: PassMIT
Windows App SDK Issue Triage Reportmicrosoft/WindowsAppSDK4.7k—~3.4kAutomated safety check: PassApache-2.0
Evaluate PR Testsdotnet/maui23k—~2.9kAutomated safety check: PassMIT
Translation ReviewDevolutions/UniGetUI26k—~1.3kAutomated safety check: PassMIT

Similar skills

  • Pester Failure Analysis

    PowerShell/PowerShell

    Investigates failing Pester tests in PowerShell CI jobs by following a six-step workflow from pull request status to documented fix recommendations.

    56k GitHub stars~5.1k tokensUpdated today
    Testing & QAAuto-check passed
  • Mines local Copilot CLI session logs for dotnet/maui to rank costly or failing runs, tag recurring failure modes, propose repo edits and emit guard evals.

    23k GitHub stars~3.4k tokensUpdated today
    Agent WorkflowsAuto-check passed
  • Official

    Generates GitHub Feature Area Status reports for the Windows App SDK repository, scoring issues so teams can see what needs attention in each area.

    4.7k GitHub stars~3.4k tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Official

    Reviews the tests added in a pull request for fix coverage, quality, edge cases and test type, and recommends lighter test types where they would do.

    23k GitHub stars~2.9k tokensUpdated today
    Testing & QAAuto-check passed
  • Translation Review

    Devolutions/UniGetUI

    Reviews UniGetUI .json language files for localization quality, detects parity issues, English-equal entries, wrong-script content, and cross-language outliers, then generates a dataset for…

    26k GitHub stars~1.3k tokensUpdated yesterday
    Frontend & DesignAuto-check passed
  • Pebrel Runtime

    Kuddev/pebrel

    Control the live Pebrel terminal workspace from Codex or Claude Code.

    3.1k GitHub stars~3.5k tokensUpdated 2 days ago
    DevelopmentAuto-check passed

More from taracodlabs/aiden

All 63 skills in this repo
  • Google Flights Search

    taracodlabs/aiden

    Searches Google Flights for prices, schedules and availability through browser automation with URL-based queries, and stops short of booking.

    851 GitHub stars~1.5k tokensUpdated 26 days ago
    Auto-check passed
  • OpenAI Codex CLI Bridge

    taracodlabs/aiden

    Delegates code generation, editing and explanation tasks to the OpenAI Codex CLI, with commands for interactive, auto-edit, question-only and model-specific runs.

    851 GitHub starsUsed in 1 repo~826 tokens
    Auto-check passed
  • Google Hotels Search

    taracodlabs/aiden

    Searches Google Hotels through the agent-browser tool for prices, ratings, amenities and availability, building a search URL from the location and dates and reporting a results table.

    851 GitHub stars~1.5k tokensUpdated 26 days ago
    Auto-check passed
  • Generates dark-themed architecture, component, data-flow and network diagrams as self-contained HTML and SVG files that open in any browser.

    851 GitHub stars~1.3k tokensUpdated 26 days ago
    Auto-check passed
  • Aggregates holdings across Zerodha, Upstox and Angel One and normalizes order parameters into one format, with confirmation required before any routing.

    851 GitHub stars~1.1k tokensUpdated 26 days ago
    Auto-check passed
  • arXiv Paper Search

    taracodlabs/aiden

    Searches arXiv by keyword, category, author or paper ID through its public API and downloads PDFs, with no API key needed.

    851 GitHub stars~1k tokensUpdated 26 days ago
    Auto-check passed

Works with

Questions about Defender Quickscan

What does Defender Quickscan do?

Windows Defender: scans, threat history, signatures (PowerShell). Defender Quickscan is an agent skill from taracodlabs/aiden.

How do I install Defender Quickscan in Claude Code?

Run `npx skills add taracodlabs/aiden --skill defender-quickscan -a claude-code`. Or copy the skill folder (skills/defender-quickscan in taracodlabs/aiden) into .claude/skills/defender-quickscan in your project. Claude Code loads it when a task matches its description.

How do I install Defender Quickscan in Codex?

Run `npx skills add taracodlabs/aiden --skill defender-quickscan -a codex`. Or copy the skill folder (skills/defender-quickscan in taracodlabs/aiden) into .agents/skills/defender-quickscan in your project. Codex loads it when a task matches its description.

Can I use Defender Quickscan in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add taracodlabs/aiden --skill defender-quickscan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defender-quickscan, .gemini/skills/defender-quickscan, .github/skills/defender-quickscan and .opencode/skills/defender-quickscan in your project.

What does Defender Quickscan need to run?

SKILL.md names no scripts, command-line tools or credentials: Defender Quickscan is instructions for the agent only.

Does Defender Quickscan access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Defender Quickscan safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Defender Quickscan use?

Defender Quickscan is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Defender Quickscan use?

About 751 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Defender Quickscan?

Skills that share tags, products or a category with Defender Quickscan: Pester Failure Analysis (PowerShell/PowerShell, 56k stars), Copilot Session Failure Analysis (dotnet/maui, 23k stars), Windows App SDK Issue Triage Report (microsoft/WindowsAppSDK, 4.7k stars) and Evaluate PR Tests (dotnet/maui, 23k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Defender Quickscan?

taracodlabs (a GitHub organization) maintains it in taracodlabs/aiden, which has 851 GitHub stars. The repository holds 63 skills in this directory. The repository was last updated on September 13, 2026.

Source: taracodlabs/aiden on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.