You can do scanning, but take the results with a grain of salt. If it were easy to dectect, Itch would have auto quarantined it. They have scanners too.
And practially all the usual game engines have or had false positives. Godot packed exes are notorious for that. But also renpy and rpgmaker and probably all the others at one version or another.
Plus I have seen malware that did not trigger. I know it was malware because of circumstances. Some tactics involve downloading the payload at a later time, so there is nothing there yet to scan. Also, just stealing your data is harm, but very hard to scan for.