How do I install the Virustotal Reputation skill?

Run npx skillmds@latest add plurigrid/virustotal-reputation in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Virustotal Reputation safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Virustotal Reputation?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Virustotal Reputation free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Virustotal Reputation?

plurigrid (@plurigrid) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Virustotal Reputation by plurigrid — Agent Skill

Name: Virustotal Reputation
Author: plurigrid

Virustotal Reputation

Use when users ask to check a file/hash/URL/IP/domain with VirusTotal, confirm malware reputation, investigate possible false positives, or compare AV detections. Prefer hash-based lookup first and use Exa to find public VirusTotal report links.

plurigrid Updated Sep 17, 2026

File contents

VirusTotal Reputation

Perform structured VirusTotal-style reputation triage and report risk with explicit confidence.

Workflow

Identify indicator type: sha256 (preferred), sha1/md5, filename+publisher, URL, domain, or IP.
Perform hash-first discovery:
- Query exact file hash first: site:virustotal.com/gui/file <hash>.
- If hash is unavailable, query filename and correlate with vendor, signature, and date context.
Search with Exa using mcp__exa__web_search_exa and prioritize direct VirusTotal GUI result URLs over reposts.
Grade confidence:
- High: exact hash match and consistent publisher context.
- Medium: filename/context match without exact hash confirmation.
- Low: no direct report match or conflicting context.
Return verdict, confidence, evidence, and next verification action.

Query Patterns (Exa)

site:virustotal.com/gui/file <sha256>
"<filename>.exe" "virustotal.com/gui/file"
"<vendor>" "<filename>" "VirusTotal"
site:virustotal.com/gui/url <url>
site:virustotal.com/gui/domain <domain>
site:virustotal.com/gui/ip-address <ip>

Risk Interpretation

Treat low detections on properly signed vendor updater/firmware binaries as possible false positives.
Do not declare a sample "clean" based only on low or zero detections.
Elevate risk when any of the following exists:
- signature is missing/invalid for expected publisher
- path and execution context are inconsistent with legitimate updater behavior
- parent process chain is unrelated or suspicious
- sandbox behavior indicates credential theft, persistence, injection, or network beaconing

Privacy/Safety

Prefer hash lookups before file uploads.
Do not upload sensitive/private binaries unless user explicitly asks.
If uncertainty remains, recommend local hash/signature verification plus multi-source triage.

Quick Commands (User Device)

Windows PowerShell

Get-FileHash "C:\path\to\file.exe" -Algorithm SHA256
Get-AuthenticodeSignature "C:\path\to\file.exe" | Format-List Status,SignerCertificate

Windows CMD

certutil -hashfile "C:\path\to\file.exe" SHA256

Response Template

Verdict: <likely benign / suspicious / likely malicious> (confidence: <low|medium|high>)

Evidence:
1. <direct VT link or "no direct VT match">
2. <hash/signature/vendor correlation>
3. <detection context / recency / behavior notes>

Next step:
1. <specific command or verification action>

---name: virustotal-reputationdescription: Use when users ask to check a file/hash/URL/IP/domain with VirusTotal, confirm malware reputation, investigate possible false positives, or compare AV detections. Prefer hash-based lookup first and use Exa to find public VirusTotal report links.---# VirusTotal ReputationPerform structured VirusTotal-style reputation triage and report risk with explicit confidence.## Workflow1. Identify indicator type: `sha256` (preferred), `sha1`/`md5`, filename+publisher, URL, domain, or IP.2. Perform hash-first discovery: - Query exact file hash first: `site:virustotal.com/gui/file <hash>`. - If hash is unavailable, query filename and correlate with vendor, signature, and date context.3. Search with Exa using `mcp__exa__web_search_exa` and prioritize direct VirusTotal GUI result URLs over reposts.4. Grade confidence: - High: exact hash match and consistent publisher context. - Medium: filename/context match without exact hash confirmation. - Low: no direct report match or conflicting context.5. Return verdict, confidence, evidence, and next verification action.## Query Patterns (Exa)- `site:virustotal.com/gui/file <sha256>`- `"<filename>.exe" "virustotal.com/gui/file"`- `"<vendor>" "<filename>" "VirusTotal"`- `site:virustotal.com/gui/url <url>`- `site:virustotal.com/gui/domain <domain>`- `site:virustotal.com/gui/ip-address <ip>`## Risk Interpretation- Treat low detections on properly signed vendor updater/firmware binaries as possible false positives.- Do not declare a sample "clean" based only on low or zero detections.- Elevate risk when any of the following exists: - signature is missing/invalid for expected publisher - path and execution context are inconsistent with legitimate updater behavior - parent process chain is unrelated or suspicious - sandbox behavior indicates credential theft, persistence, injection, or network beaconing## Privacy/Safety- Prefer hash lookups before file uploads.- Do not upload sensitive/private binaries unless user explicitly asks.- If uncertainty remains, recommend local hash/signature verification plus multi-source triage.## Quick Commands (User Device)### Windows PowerShell```powershellGet-FileHash "C:\path\to\file.exe" -Algorithm SHA256Get-AuthenticodeSignature "C:\path\to\file.exe" | Format-List Status,SignerCertificate```### Windows CMD```cmdcertutil -hashfile "C:\path\to\file.exe" SHA256```## Response Template```markdownVerdict: <likely benign / suspicious / likely malicious> (confidence: <low|medium|high>)Evidence:1. <direct VT link or "no direct VT match">2. <hash/signature/vendor correlation>3. <detection context / recency / behavior notes>Next step:1. <specific command or verification action>```

Frequently asked questions