hashcheck

Analyze file hashes across malware intelligence APIs for security triage.

6|Updated Jul 22, 2026
One-click install
npx skills add https://github.com/Snausage0x45/ClaudeSkills --skill hashcheck
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: hashcheck
Source: https://github.com/Snausage0x45/ClaudeSkills/tree/main/hashcheck
Command: npx skills add https://github.com/Snausage0x45/ClaudeSkills --skill hashcheck

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the tedious process of gathering threat intelligence on suspicious files, allowing analysts to quickly determine if a file is malicious, benign, or unknown without manual lookups.

Core Features & Use Cases

  • Multi-Source Triage: Aggregates data from VirusTotal, MalwareBazaar, Hybrid Analysis, and Joe Sandbox to provide a comprehensive security briefing.
  • Passive Reconnaissance: Performs safe, read-only analysis by checking file fingerprints against public databases without ever executing the sample.
  • Use Case: When you receive an email attachment or download a suspicious binary, use this Skill to instantly identify its threat family, code-signing status, and behavioral indicators to decide whether to quarantine the file.

Quick Start

Use the hashcheck skill to investigate the reputation and threat profile of the file located at /downloads/suspicious_installer.exe.

Frequently Asked Questions about hashcheck

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive malware triage on a file hash without detonating the sample?

Passive malware triage involves checking file hashes against public threat intelligence databases to analyze reputation without execution. This Skill performs read-only OSINT lookups across multiple engines to assess threat families and behavioral indicators safely.

Can I check code-signing provenance and file structure during threat intelligence investigations?

Yes, threat intelligence investigations can analyze code-signing provenance and file structure. This Skill examines these attributes alongside multi-engine detection consensus to provide a comprehensive security briefing for suspicious files.

How do I aggregate malware analysis results from VirusTotal, MalwareBazaar, and Hybrid Analysis?

Aggregating malware analysis results requires querying multiple threat intelligence APIs for a unified view. This Skill automates data collection from sources like VirusTotal, MalwareBazaar, Hybrid Analysis, and Joe Sandbox to build a consensus briefing.

Does OSINT file reputation analysis work for identifying unknown malicious binaries?

OSINT file reputation analysis works for identifying unknown binaries by comparing their fingerprints against known malware databases. This Skill evaluates whether a file is malicious, benign, or unknown to help decide if quarantine is necessary.

What are the limitations of passive hash-based threat assessment?

Passive hash-based threat assessment is limited to known file fingerprints and cannot detect zero-day malware or heavily obfuscated polymorphic samples. It performs non-detonating read-only lookups, meaning behavioral analysis depends entirely on existing sandbox reports.

What is the best way to triage suspicious email attachments for security threats?

The best way to triage suspicious email attachments is automated multi-source OSINT analysis. This Skill instantly identifies the threat family, code-signing status, and behavioral indicators of downloaded files to determine if quarantine is required.