# Virustotal

VirusTotal: check file/URL/domain/IP against 70+ AV engines

- Repository: https://github.com/taracodlabs/aiden (868 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-19
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add taracodlabs/aiden --skill virustotal -g -a claude-code -y`
Codex: `npx skills add taracodlabs/aiden --skill virustotal -g -a codex -y`
Cursor: `npx skills add taracodlabs/aiden --skill virustotal -g -a cursor -y`
Gemini CLI: `npx skills add taracodlabs/aiden --skill virustotal -g -a gemini-cli -y`

## Description

VirusTotal: check file/URL/domain/IP against 70+ AV engines

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# VirusTotal, Threat Intelligence

VirusTotal aggregates results from 70+ antivirus engines and threat intelligence feeds. Check file hashes, URLs, domains, and IP addresses for known malware, phishing, and suspicious activity.

**Requires:** `VIRUSTOTAL_API_KEY`, free at https://www.virustotal.com/gui/my-apikey (4 req/min on free tier).

## When to Use

- User has a file hash and wants to know if it is malware
- User has a suspicious URL and wants a reputation check
- User is investigating an incident and needs threat context for a domain or IP
- User asks "is this hash malicious?", "check this URL", or "is this domain flagged?"
- SOC/IR workflow: triage IOCs (indicators of compromise) quickly

## How to Use

### Check a file hash (MD5, SHA-1, or SHA-256)

```powershell
$hash = "44d88612fea8a8f36de82e1278abb02f"   # EICAR test file
$key  = $env:VIRUSTOTAL_API_KEY
$url  = "https://www.virustotal.com/api/v3/files/$hash"

$result = Invoke-RestMethod -Uri $url -Headers @{ "x-apikey" = $key }
$stats  = $result.data.attributes.last_analysis_stats
Write-Host "File: $($result.data.attributes.meaningful_name)"
Write-Host "Malicious:  $($stats.malicious) / $($stats.malicious + $stats.undetected + $stats.harmless)"
Write-Host "Suspicious: $($stats.suspicious)"
Write-Host "First seen: $($result.data.attributes.first_submission_date)"
```

### Check a URL for malware or phishing

```powershell
$targetUrl = "https://example.com"
$key       = $env:VIRUSTOTAL_API_KEY

# URL id = URL-safe base64 without padding
$bytes  = [System.Text.Encoding]::UTF8.GetBytes($targetUrl)
$b64    = [Convert]::ToBase64String($bytes).Replace('+','-').Replace('/','_').TrimEnd('=')
$url    = "https://www.virustotal.com/api/v3/urls/$b64"

The rest: https://github.com/taracodlabs/aiden/blob/HEAD/skills/virustotal/SKILL.md