AgentGuard

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:18 AM UTC
• Version: 1.0.12

Overview

AgentGuard appears to be a legitimate security tool, but it needs Review because it asks for broad local security access and has some fail-open/under-scoped behavior.

Install only if you want to grant a security auditor broad local visibility into installed skills, workspaces, credential-directory metadata, environment names, agent configs, network state, cron jobs, and Web3 action context. Review generated reports before sharing them, verify the AgentGuard dependency/version, and enable auto-scan or daily patrol only if you want ongoing local monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The invocation description is very broad and can cause the skill to activate for many generic security-related prompts, increasing the chance that sensitive scans run when the user did not intend them. In this skill's context, that matters because the skill is authorized to inspect sensitive directories, environment data, cron/jobs, and network state.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill requests access to sensitive locations such as `~/.ssh/`, `~/.gnupg/`, agent config directories, and environment data without a prominent upfront warning about the privacy/security implications. Users may invoke it expecting a normal code scan but inadvertently authorize broad host inspection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The degradation strategy explicitly says phishing and address-security failures are silently skipped when GoPlus is unavailable. In a security guard skill, this creates fail-open behavior: high-value security checks may disappear without an immediate, explicit warning, causing risky Web3 actions to be evaluated on incomplete evidence.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script writes attacker-controlled report content into an HTML file and automatically opens it in the default browser. Even though many fields are escaped, the generated page includes significant active JavaScript and external resources, so opening it automatically increases the risk surface for unwanted network access, browser-based abuse, or user deception in a security tool context.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This hook is a security enforcement point, but if the AgentGuard engine cannot be loaded it explicitly prints a message and exits with code 0, which allows the action to proceed unchecked. In a tool intended to block dangerous commands and prevent data leaks, failing open turns any packaging/import/path issue into a security bypass and is especially dangerous because the user may not notice the protection is inactive.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

4. **[REQUIRED] Network exposure** (→ feeds Dimension 3: Network & System): Run `lsof -i -P -n 2>/dev/null | grep LISTEN` or `ss -tlnp 2>/dev/null` to check for dangerous open ports (Redis 6379, Docker API 2375, MySQL 3306, MongoDB 27017 on 0.0.0.0)
5. **[REQUIRED] Scheduled tasks audit** (→ feeds Dimension 3: Network & System): Check `crontab -l 2>/dev/null` for suspicious entries containing `curl|bash`, `wget|sh`, or accessing `~/.ssh/`
6. **[REQUIRED] Environment variable exposure** (→ feeds Dimension 3: Network & System): Run `env` and check for sensitive variable names (`PRIVATE_KEY`, `MNEMONIC`, `SECRET`, `PASSWORD`) — detect presence only, mask values
7. **[REQUIRED] Runtime protection check** (→ feeds Dimension 4: Runtime Protection): Check if security hooks exist in `~/.claude/settings.json` or `~/.openclaw/openclaw.json`, check for audit logs at `~/.agentguard/audit.jsonl`

### Step 2: Score Calculation

• Confidence: 89% confidence
• Finding: ~/.claude/settings.json

Credential Access

High

• Category: Privilege Escalation

Content

3. Check permissions on critical files:
   - `$OC/openclaw.json` → should be 600
   - `$OC/devices/paired.json` → should be 600
   - `~/.ssh/authorized_keys` → should be 600
4. Detect new executable files in workspace: `find $OC/workspace/ -type f -perm +111 -mtime -1`

#### [6] Audit Log Analysis (24h)

• Confidence: 83% confidence
• Finding: ~/.ssh/authorized_keys

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "type": "module",
  "dependencies": {
    "@goplus/agentguard": "^1.0.6",
    "open": "11.0.0"
  }
}

• Confidence: 95% confidence
• Finding: "@goplus/agentguard": "^1.0.6"

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.