feat: add VirusTotal API integration for skill security scanning#410
feat: add VirusTotal API integration for skill security scanning#410marcusquinn merged 1 commit intomainfrom
Conversation
Add virustotal-helper.sh wrapping VT API v3 for advisory threat intelligence on imported skills. Scans file hashes against 70+ AV engines and checks domain/URL reputation referenced in skill content. Integration points: - security-helper.sh: new vt-scan command + advisory VT layer in skill-scan - add-skill-helper.sh: VT advisory scan after GitHub and ClawdHub imports - skill-scanner.md and security-analysis.md: updated documentation - README.md: VT listed in security tools and skill scanning sections Design: VT scans are advisory/non-blocking (Cisco scanner remains the gate). Rate limited to free tier (4 req/min, max 8 per skill scan).
Summary of ChangesHello @marcusquinn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security scanning capabilities for imported skills by integrating the VirusTotal API. It introduces an advisory layer of threat intelligence, allowing the system to check file hashes and domain/URL reputations against VirusTotal's extensive database. This integration provides an additional security check without impeding the existing Cisco Skill Scanner, ensuring a more robust and comprehensive security posture for skill imports. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
WalkthroughThis PR introduces VirusTotal threat intelligence integration into the security scanning workflow. A new virustotal-helper.sh script provides comprehensive VirusTotal API v3 support for scanning files, URLs, domains, and skill directories. Integration points in security-helper.sh and add-skill-helper.sh incorporate optional VT scans post-security checks. All VT findings remain advisory and non-blocking. Changes
Sequence Diagram(s)sequenceDiagram
participant User as User/CLI
participant ASH as add-skill-helper.sh
participant SH as security-helper.sh
participant CScan as Cisco Security<br/>Scanner
participant VTHelper as virustotal-helper.sh
participant VTAPI as VirusTotal API v3
User->>ASH: add skill command
ASH->>SH: invoke security scan
SH->>CScan: run blocking<br/>security check
CScan-->>SH: scan results
alt Cisco clears skill
SH->>VTHelper: scan_skill_virustotal<br/>(advisory)
VTHelper->>VTHelper: compute file hashes<br/>extract domains/URLs
VTHelper->>VTAPI: query file hashes<br/>domain reputation
VTAPI-->>VTHelper: threat intelligence
VTHelper->>VTHelper: aggregate results<br/>parse verdicts
VTHelper-->>SH: advisory findings<br/>(non-blocking)
SH-->>ASH: advisory status only
else Cisco blocks
SH-->>ASH: failed (blocks skill)
end
alt VT findings present
ASH->>ASH: log advisory warnings
end
ASH->>User: proceed with registration<br/>(or halt if Cisco blocked)
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Sat Feb 7 01:18:00 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a valuable security enhancement by integrating VirusTotal for advisory scanning of skills. The implementation is comprehensive, including a new helper script, integration into existing security workflows, and updated documentation. My review focuses on improving the robustness and correctness of the new virustotal-helper.sh script, particularly around error handling, logging, and script efficiency. I've also noted a minor documentation inconsistency in add-skill-helper.sh. Overall, this is a solid addition to the project's security capabilities.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Fix all issues with AI agents
In @.agents/scripts/add-skill-helper.sh:
- Around line 611-616: The log points users to "virustotal-helper.sh" without a
path; update the warning/info messages around the "$vt_helper" call (the block
using vt_helper scan-skill and the log_info/log_warning functions) to print the
explicit path to the helper binary/script (use the value of the vt_helper
variable or resolve it via which/command -v) so the guidance works even when the
script is not in PATH; keep messages advisory (no exit change) but include the
resolved path in both the log_warning and the follow-up log_info.
In @.agents/scripts/security-helper.sh:
- Around line 583-600: The VT scan currently always calls "$vt_helper"
scan-skill on the directory (scan_dir), which causes full-directory scans for
single-file skills; change the logic to detect file-based skills by checking
full_path and the filename pattern (e.g., basename matching "*-skill.md" or
simply that full_path is a regular file representing the skill) and call
"$vt_helper" scan-file "$full_path" for those, otherwise keep using "$vt_helper"
scan-skill "$scan_dir"; preserve the existing --quiet, stderr suppression, the
vt_issues increment and the echo "VT flagged issues" message/error handling
around the command so behavior and logging remain consistent.
In @.agents/scripts/virustotal-helper.sh:
- Around line 490-635: The script currently only increments request_count on
successful vt_request calls (in both file-hash phase and domain phase), which
allows failed lookups to bypass your max_requests cap; update the logic around
vt_request (the GET calls in the file-hash loop and the domain loop where
vt_request is invoked) to count every request attempt regardless of success by
incrementing request_count immediately after invoking vt_request (or in the
failure branches) and before any continue/skip, and ensure rate_limit_wait is
still called consistently between attempts (i.e., keep calling rate_limit_wait
when request_count < max_requests).
- Around line 138-266: Ensure jq is present and make vt_request capture and
return HTTP status codes and JSON validation: inside vt_request check command -v
jq and fail early if missing; call curl with -w "%{http_code}" to capture
body+status, split them, validate body is JSON with jq -e . before any jq
parsing, and treat non-200 statuses as errors (but return status 404 separately
so caller can treat "not found" differently). Update cmd_scan_file to call
vt_request and inspect the returned status code (or special return format) so
only a 404 leads to the "file not in VT database" path while other HTTP errors
(401, 429, 5xx) and JSON/parse errors are logged/returned as failures; keep
existing helpers like file_sha256 and parse_verdict unchanged but ensure callers
only invoke jq on validated JSON.
…ting (t147.3) - Redirect all log functions to stderr to prevent stdout pollution in command substitution - Return exit code 2 from vt_request for NotFoundError, allowing callers to distinguish 404 from quota/network errors - Fix cmd_scan_file to propagate real API errors instead of treating all failures as 'not in database' - Count every API request attempt toward rate limit, not just successful ones - Replace O(n²) domain dedup loop with associative array lookup - Add early jq dependency check in main() for clear error messaging - Fix security-helper.sh to scan file directly for file-based skills instead of entire parent directory - Fix add-skill-helper.sh: correct return value comment, use resolved path in log message Addresses 9 review threads (3 high, 3 major, 3 medium) from PR #410. Closes #444
…ting (t147.3) (#468) * chore: mark t135.8 blocked in TODO.md * fix: harden VirusTotal error handling, logging, and rate-limit accounting (t147.3) - Redirect all log functions to stderr to prevent stdout pollution in command substitution - Return exit code 2 from vt_request for NotFoundError, allowing callers to distinguish 404 from quota/network errors - Fix cmd_scan_file to propagate real API errors instead of treating all failures as 'not in database' - Count every API request attempt toward rate limit, not just successful ones - Replace O(n²) domain dedup loop with associative array lookup - Add early jq dependency check in main() for clear error messaging - Fix security-helper.sh to scan file directly for file-based skills instead of entire parent directory - Fix add-skill-helper.sh: correct return value comment, use resolved path in log message Addresses 9 review threads (3 high, 3 major, 3 medium) from PR #410. Closes #444
1 participant
Summary
virustotal-helper.sh(~814 lines) wrapping VirusTotal API v3 for advisory threat intelligence on imported skillssecurity-helper.sh(newvt-scancommand + advisory layer inskill-scan)add-skill-helper.shfor both GitHub and ClawdHub skill importsskill-scanner.md,security-analysis.md,README.md)What it does
VirusTotal provides a second layer of security scanning alongside the Cisco Skill Scanner:
Design decisions
VIRUSTOTAL_MARCUSQUINNin encrypted gopass storageTesting
virustotal-helper.sh status- API key verified, account confirmedvirustotal-helper.sh scan-file- File hash lookup works (text files correctly return UNKNOWN)virustotal-helper.sh scan-domain google.com- Domain reputation check workssecurity-helper.sh vt-scan status- Delegation through security-helper workssecurity-helper.sh status- VT shows as configured in tool statusFiles changed
.agents/scripts/virustotal-helper.sh.agents/scripts/security-helper.shcmd_vt_scan(), VT advisory incmd_skill_scan(), fix VT status check.agents/scripts/add-skill-helper.shscan_skill_virustotal()+ 2 call sites.agents/tools/code-review/skill-scanner.md.agents/tools/code-review/security-analysis.mdREADME.mdSummary by CodeRabbit
New Features
Documentation