AbuseIPDB API reference. IP reputation and abuse report lookups.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
免费在 GitHub 公开
virustotal-api
VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.
中文简介正在准备中。当前显示原文说明。
查看安装方法包含的文件（1）
- SKILL.md2.8 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
VirusTotal API v3
Base URL
https://www.virustotal.com/api/v3
Authentication
Header: x-apikey: $VIRUSTOTAL_API_KEY
Check for key: echo $VIRUSTOTAL_API_KEY
If empty, inform the user to run scripts/setup.sh or set the environment variable.
Rate Limits
- Free: 4 requests/minute, 500/day, 15.5K/month
- Premium: 1000 requests/minute
Key Endpoints
File Analysis
# Lookup by hash (MD5, SHA-1, SHA-256)
curl -s "https://www.virustotal.com/api/v3/files/{hash}" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Useful response fields:
data.attributes.last_analysis_stats— detection counts (malicious, suspicious, undetected)data.attributes.popular_threat_classification— malware familydata.attributes.names— file namesdata.attributes.type_description— file typedata.attributes.size— file sizedata.attributes.tags— behavioral tagsdata.attributes.sandbox_verdicts— sandbox results
IP Address
curl -s "https://www.virustotal.com/api/v3/ip_addresses/{ip}" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Useful fields: last_analysis_stats, as_owner, country, reputation, last_https_certificate
Relationships (communicating files, downloaded files, URLs):
curl -s "https://www.virustotal.com/api/v3/ip_addresses/{ip}/communicating_files?limit=10" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Domain
curl -s "https://www.virustotal.com/api/v3/domains/{domain}" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Useful fields: last_analysis_stats, registrar, creation_date, last_dns_records, reputation, categories
URL
URLs must be base64-encoded (without trailing =):
URL_ID=$(echo -n "https://example.com/path" | base64 | tr -d '=')
curl -s "https://www.virustotal.com/api/v3/urls/$URL_ID" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Common Query Patterns
Quick reputation check (any indicator type)
Return a summary: detection ratio, community score, key context.
File behavior analysis
curl -s "https://www.virustotal.com/api/v3/files/{hash}/behaviours" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Search for related indicators
curl -s "https://www.virustotal.com/api/v3/intelligence/search?query={query}" \
-H "x-apikey: $VIRUSTOTAL_API_KEY"
Note: Intelligence search requires premium API.
Response Summary Format
Return results as:
indicator: <value>
type: <ip|domain|hash|url>
detection_ratio: X/Y
community_score: <number>
verdict: malicious|suspicious|clean|unknown
key_findings:
- <finding 1>
- <finding 2>
raw_api_response: <truncated key fields>
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
ach
免费Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Censys API v2 reference. Host reconnaissance and certificate data.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Liberty91LTD/cti-skills272026年9月30日 更新