vt-sentinel

VT Sentinel — VirusTotal Active Protection

Protects OpenClaw users with active prevention, not just detection:

1. Antivirus engines — 60+ vendors check file hashes for known malware
2. AI Code Insight — VirusTotal AI-powered semantic analysis for scripts, skills, binaries
3. Active blocking — Files detected as malicious are blocklisted and quarantined. Any subsequent attempt to execute them is automatically blocked before it runs.

Both AV and AI sources are always checked. The final verdict is the worst of the two. Malicious files are quarantined (renamed to .QUARANTINED) and added to a runtime blocklist that prevents their execution via exec or bash tools.

Available Tools

vt_scan_file — Full File Scan

Classifies the file, computes SHA-256, checks VT (AV + Code Insight), uploads if unknown.

vt_scan_file { "path": "/absolute/path/to/file" }

vt_check_hash — Quick Hash Lookup

Fast check of a SHA-256 hash against VT. Returns AV detections + Code Insight if available.

vt_check_hash { "hash": "e3b0c44298fc1c149afbf4c8996fb924..." }

vt_upload_consent — Confirm Sensitive File Upload

When vt_scan_file returns needs_consent, relay the user's decision.

vt_upload_consent { "path": "/path/to/document.pdf", "upload": true }
vt_upload_consent { "path": "/path/to/document.pdf", "upload": false }

When to Use Which Tool

Scenario	Tool
User asks "is this file safe?"	vt_scan_file
User provides a SHA-256 hash	vt_check_hash
Evaluating a new SKILL.md or HOOK.md	vt_scan_file
Checking a downloaded script or binary	vt_scan_file
User said YES/NO to uploading a sensitive file	vt_upload_consent

Interpreting Results

Every result includes both AV detections and Code Insight (when available):

File: example.sh
Category: HIGH_RISK
Verdict: MALICIOUS
Detections: 12 malicious, 0 suspicious / 64 engines
Code Insight (Code Insight): MALICIOUS
Analysis: This script downloads and executes a remote payload...
VT Link: https://www.virustotal.com/gui/file/...
Summary: AV: 12/64 engines detected malware | AI: MALICIOUS — ...