VirusTotal Hash Analyzer

Instantly check if a file, URL, domain, or IP is malicious using VirusTotal. Paste any MD5/SHA1/SHA256 hash, URL, domain name, or IP address into the chat an...

This skill appears to do what it says: it calls VirusTotal v3 endpoints using the VT_API_KEY you provide and returns JSON reports for hashes/URLs/domains/IPs. Consider the following before installing/using: (1) Any IOC you submit is sent to VirusTotal and may be logged/shared per their policy — do not submit sensitive secrets or private data you cannot disclose. (2) Provide an API key with appropriate rate/quota limits; do not use broader credentials than needed. (3) The script can read IOCs from a file when you pass --file: only supply files you intend to query (don’t point it at arbitrary system files). (4) The SKILL.md command looks for the skill under /root/.openclaw — ensure the skill was installed from a trusted source and runs in an expected environment. If you need higher assurance, review the full vt_lookup.py source yourself (it is included) or run it in an isolated environment.

Type: OpenClaw Skill Name: vt-hash-intel Version: 1.0.2 The OpenClaw AgentSkill 'vt-hash-intel' is designed for querying VirusTotal for threat intelligence on hashes, URLs, domains, and IP addresses. The `SKILL.md` provides clear, detailed instructions for the AI agent to perform comprehensive analysis and reporting, including contextual flags for suspicious indicators (e.g., newly registered domains, suspicious TLDs). The `vt_lookup.py` script correctly implements the VirusTotal API interaction, handles rate limiting, and includes defanging logic for IOCs. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior. All network calls are directed to the legitimate VirusTotal API endpoint, and the code uses standard Python libraries without suspicious external dependencies.