Look up one sha256 content hash against the known-bad indicator store (free, no API key)
known_bad_lookupCheck a SHA256 hash against a daily updated store of known-malicious file indicators to get an instant yes/no verdict on whether the hash matches a known bad artifact.
Instructions
Checks a single sha256 content hash against Lazaretto's known-bad indicator store, which is refreshed daily from abuse.ch feeds (URLhaus / ThreatFox).
WHEN TO USE: when you already have the hash of a file or artifact and want an instant yes/no on identity. Prefer check_lockfile when you have a dependency tree instead of a hash. Prefer scan_artifact when you have a package, repo, or skill and need to know how it behaves rather than whether its hash is already listed.
COST AND EFFECTS: free, no API key, no payment. Read-only, a single HTTPS lookup.
LIMITS: this is an EXACT hash match. It performs no analysis of content, so a repacked or even trivially modified variant hashes differently and will not match.
READING THE RESULT: matched: true means this exact hash is a known-bad artifact, and
sources names the feeds it came from. matched: false means only that this hash is absent
from the indicator set, which is NOT a clean verdict on the artifact. matched: null means the
store could not be consulted, which is also not a clean verdict. For an actual behavioral
opinion, use scan_artifact.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sha256 | Yes | A sha256 content hash as 64 hex characters, with or without a leading "sha256:" prefix. This is the hash of the artifact bytes themselves (for example `shasum -a 256 file.tgz`), not of a URL or a package name. |