A comprehensive security intelligence tool for identifying and analyzing malicious files, URLs, domains, and IP addresses via VirusTotal.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install vt-hash-intel
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install vt-hash-intel using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is VirusTotal Threat Intelligence (vt-hash-intel)?
The vt-hash-intel skill is a powerful extension designed for Openclaw Skills that integrates the VirusTotal API directly into your AI agent's workflow. It allows for the rapid identification and analysis of Indicators of Compromise (IOCs) across 70+ security engines, providing deep insights into potential threats including malware families, YARA matches, and sandbox verdicts.
By utilizing this skill, security analysts and developers can automate the enrichment of security data, transforming raw hashes or suspicious URLs into actionable threat reports. It serves as a vital component for maintaining a robust security posture within an AI-driven development or incident response environment, ensuring that no malicious entity goes unnoticed.
VirusTotal Threat Intelligence (vt-hash-intel) Use Cases
- Rapid incident response and SOC triage to identify malicious files and network traffic.
- Automated enrichment of security logs by checking suspicious IPs and domains.
- Investigating potentially malicious URLs or defanged links found in phishing reports.
- Performing batch lookups of multiple IOCs to assess broad security threats.
- Validating the safety of file downloads by analyzing MD5, SHA1, or SHA256 hashes.
How VirusTotal Threat Intelligence (vt-hash-intel) Works
- The AI agent extracts IOCs such as hashes, URLs, IPs, or domains from user queries or system logs.
- The skill automatically normalizes the input, handling common security obfuscations like defanged URLs or bracketed IP addresses.
- A query is sent to the VirusTotal database via the API to retrieve real-time reputation and threat intelligence data.
- The response is parsed to determine a threat level ranging from clean to high, based on the detection ratio from security vendors.
- The agent presents a structured report including contextual data like DNS records, registrar info, and specific malware labels.
VirusTotal Threat Intelligence (vt-hash-intel) Setup
To use this skill, you must first obtain a VirusTotal API key. Once obtained, configure your environment as follows:
- Set the environment variable:
export VT_API_KEY='your_api_key_here'
- Run a lookup command through your agent or CLI:
SKILL_DIR="$(dirname "$(find /root/.openclaw -name 'SKILL.md' -path '*/vt-hash-intel/*' 2>/dev/null | head -1)")"
python3 "$SKILL_DIR/scripts/vt_lookup.py" <ioc>
VirusTotal Threat Intelligence (vt-hash-intel) Data Schema & Taxonomy
The skill returns structured JSON data containing the following key attributes for every query:
| Attribute | Type | Description |
|---|---|---|
| ioc | String | The original indicator queried |
| ioc_type | String | Detected type: hash, url, domain, or ip |
| detection_ratio | String | Number of malicious flags over total engines |
| threat_level | String | clean, low, medium, or high |
| vt_link | String | URL to the complete report on VirusTotal |
| detections | Array | List of security engines that flagged the IOC |
| reputation | Integer | Community reputation score from VirusTotal |
VirusTotal Threat Intelligence (vt-hash-intel) Advanced Features
- Automatic handling of defanged IOCs (e.g., converting hxxp to http or 1[.]2[.]3[.]4 to 1.2.3.4).
- Multi-indicator batch processing to analyze mixed types of security data in a single request.
- Deep file analysis including crowdsourced YARA rules, Sigma rules, and multi-sandbox verdicts.
- Domain-specific insights including registrar history, creation dates, and DNS records to spot newly registered domains.
- IP address enrichment providing ASN, country of origin, and network provider context for Openclaw Skills users.
SKILL.md
Loading
Related Openclaw Skills
Market Report
A professional-grade crypto market analysis tool that aggregates real-time data from CoinMarketCap to provide actionable financial summaries.
Crypto Research
A professional-grade AI research skill that performs deep-dive due diligence and technical analysis on cryptocurrencies using real-time CoinMarketCap data.
CMC DEX API Reference
A comprehensive technical skill for accessing CoinMarketCap decentralized exchange (DEX) data, including token prices, liquidity, and rug pull risk assessment.
CoinMarketCap Market Data
A comprehensive interface for accessing CoinMarketCap market-wide data, including sentiment indicators, global metrics, and historical performance indices.
macOS Calendar Assistant
An intelligent macOS-native tool for managing Calendar.app via automated scripts, supporting screenshot-to-schedule extraction and idempotent event updates.
Secret-Safe: Secure Credential Management
A foundational security framework for managing API keys and secrets within AI agent environments without exposing them to the LLM context.
Featured*
