"If you see a game with high quality graphics in the screenshots but the downloads are less than 1MB, you can be pretty sure it's just malware. "
That's not always the case. For my game the exe contains no graphic assets at all, they are loaded from our servers at login.
What i would recommend instead is testing the exe with websites like https://www.virustotal.com/gui/home/upload
There you can test any executable automatically (and for free) against 30 common antiviruses.
Viewing post in Can games from itch.io be trusted anymore ?
You can do scanning, but take the results with a grain of salt. If it were easy to dectect, Itch would have auto quarantined it. They have scanners too.
And practially all the usual game engines have or had false positives. Godot packed exes are notorious for that. But also renpy and rpgmaker and probably all the others at one version or another.
Plus I have seen malware that did not trigger. I know it was malware because of circumstances. Some tactics involve downloading the payload at a later time, so there is nothing there yet to scan. Also, just stealing your data is harm, but very hard to scan for.