malware-hash
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs its stated function without any detected malicious patterns or security risks.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
www.virustotal.com, a well-known and reputable service for malware analysis, to retrieve hash reputation data. - [CREDENTIALS_UNSAFE]: The skill manages the VirusTotal API key using secure practices, including the use of environment variables and a configuration file (
~/.config/security-skill/secrets.env) with restricted filesystem permissions (chmod 600). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the user and external data from the VirusTotal API, which is a common attack surface for indirect injection.
- Ingestion points: The
HASH_OR_FILEuser input and the JSON response from the VirusTotal API (VT_RESPONSE). - Boundary markers: None are used to isolate the external data when presented to the agent.
- Capability inventory: The skill possesses network capabilities (via
curl) and local script execution (viapython3). - Sanitization: The skill performs length validation on the hash input to ensure it matches MD5, SHA1, or SHA256 formats, reducing the risk of unexpected input processing.
Audit Metadata