ClawHub
Back to skill

Security audit

360Guard

Security checks for vulnerabilities and agentic risk

Overview

360Guard is a disclosed local security-check skill, but its comprehensive scanner claims are not supported by its simple scanners, which can miss common executable skill files and still report a clean result.

Use this skill only as a rough heuristic checklist, not as proof that another skill is safe. Prefer manual review and more complete tooling for any high-risk skill, run scans on local copies when possible, expect optional GitHub/ClawHub commands to contact external services, and avoid treating a clean 360Guard result as an install approval.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/scanner.cjs:9
Finding

Security Scanner Coverage Gaps Allow Malicious Payloads to Evade Detection

Content
View full analysis
/dev/null | head -5 # Check sensitive file access echo -e "\n🔑 Sensitive path check:" grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys\|keychain\|credentials" "$SKILL_PATH" \ --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null # Check dangerous commands echo -e "\n⚠️ Dangerous command check:" grep -r "eval\|exec\|shell=True\|base64 -d\|openssl\|subprocess" "$SKILL_PATH" \ --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null # Check persistence echo -e "\n⏰ Persistence check:" grep -r "cron\|systemd\|launchd\|login item\|autostart\|startup" "$SKI ...[truncated 4913 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 24)May include surrounding context.

md
### 1. Persistence & Auto-start 🔴
- [x] Creates cron job / systemd service
- [x] Modifies ~/.ssh/authorized_keys
- [x] Writes to /etc/hosts
- [x] Adds Login Items / Startup Items
- [x] Modifies .bashrc / .zshrc / profile

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
### 1. Persistence & Auto-start 🔴
- [x] Creates cron job / systemd service
- [x] Modifies ~/.ssh/authorized_keys
- [x] Writes to /etc/hosts
- [x] Adds Login Items / Startup Items
- [x] Modifies .bashrc / .zshrc / profile

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill markets itself as a comprehensive security review system with behavior detection and dependency auditing, but the included implementations are mostly simple grep/regex heuristics. This can create a false sense of assurance, leading users to trust malicious skills that evade superficial pattern matching.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: 360Guard
description: 360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks and automated scanning scripts. Supports static analysis, behavior detection, dependency auditing.
---

# 360Guard 🛡️

> 360-degree comprehensive security review — Like antivirus for your Skills

## 1. When to Use

- Before installing any Skill from ClawHub
- Before installing any Skill from GitHub or other sources
- When evaluating code shared by ot

Credential Access

High
Category
Privilege Escalation
Confidence
74% confidence
Finding

The script scans for 'keychain' among sensitive indicators and may include related findings in generated reports. In a security tool this is contextual, but without output minimization it can surface sensitive context from analyzed files unnecessarily.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
# 3. Sensitive path scan
echo -e "\n🔑 Sensitive path scan:" | tee -a "$REPORT"
for pattern in "~/.ssh" "~/.aws" "~/.config" "/etc/hosts" "authorized_keys" "keychain" "credentials" ".env"; do
  result=$(grep -r "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  ⚠️ Warning: $pattern" | tee -a "$REPORT"

Credential Access

High
Category
Privilege Escalation
Confidence
74% confidence
Finding

The script scans for 'keychain' among sensitive indicators and may include related findings in generated reports. In a security tool this is contextual, but without output minimization it can surface sensitive context from analyzed files unnecessarily.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
# 3. Sensitive path scan
echo -e "\n🔑 Sensitive path scan:" | tee -a "$REPORT"
for pattern in "~/.ssh" "~/.aws" "~/.config" "/etc/hosts" "authorized_keys" "keychain" "credentials" ".env"; do
  result=$(grep -r "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  ⚠️ Warning: $pattern" | tee -a "$REPORT"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/full-scan.sh (reported line 36)May include surrounding context.

sh
# 3. Sensitive path scan
  echo "🔑 Sensitive path scan:"
  for pattern in "~/.ssh" "~/.aws" "~/.config" "/etc/hosts" "authorized_keys" "keychain" "credentials" ".env"; do
    result=$(grep -r "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null)
    if [ -n "$result" ]; then
      echo "  ⚠️ Warning: $pattern"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
# Check sensitive file access
echo -e "\n🔑 Sensitive path check:"
grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys\|keychain\|credentials" "$SKILL_PATH" \
  --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null

# Check dangerous commands

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/full-scan.sh (reported line 36)May include surrounding context.

sh
# Check sensitive file access
echo -e "\n🔑 Sensitive path check:"
grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys\|keychain\|credentials" "$SKILL_PATH" \
  --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null

# Check dangerous commands

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/quick-scan.sh (reported line 18)May include surrounding context.

sh
# Check sensitive file access
echo -e "\n🔑 Sensitive path check:"
grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys\|keychain\|credentials" "$SKILL_PATH" \
  --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null

# Check dangerous commands

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scanner.cjs (reported line 40)May include surrounding context.

js
# Check sensitive file access
echo -e "\n🔑 Sensitive path check:"
grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys\|keychain\|credentials" "$SKILL_PATH" \
  --include="*.sh" --include="*.js" --include="*.ts" --include="*.py" 2>/dev/null

# Check dangerous commands

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
MEDIUM: [
    { pattern: /\/\.ssh\//, name: 'SSH directory', desc: 'Sensitive directory access' },
    { pattern: /\/\.aws\//, name: 'AWS directory', desc: 'Cloud credential directory' },
    { pattern: /keychain/i, name: 'Keychain', desc: 'System keychain' },
    { pattern: /credentials|token|secret|api[_-]?key/i, name: 'credential related', desc: 'Sensitive information' },
    { pattern: /cron|systemd|launchd/i, name: 'persistence mechanism', desc: 'Auto-start on boot' },
    { pattern: /setTimeout|setInterval.*eval/i, name: 'timer eval', desc: 'Dynamic execution' },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

md
MEDIUM: [
    { pattern: /\/\.ssh\//, name: 'SSH directory', desc: 'Sensitive directory access' },
    { pattern: /\/\.aws\//, name: 'AWS directory', desc: 'Cloud credential directory' },
    { pattern: /keychain/i, name: 'Keychain', desc: 'System keychain' },
    { pattern: /credentials|token|secret|api[_-]?key/i, name: 'credential related', desc: 'Sensitive information' },
    { pattern: /cron|systemd|launchd/i, name: 'persistence mechanism', desc: 'Auto-start on boot' },
    { pattern: /setTimeout|setInterval.*eval/i, name: 'timer eval', desc: 'Dynamic execution' },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scanner.cjs (reported line 40)May include surrounding context.

js
MEDIUM: [
    { pattern: /\/\.ssh\//, name: 'SSH directory', desc: 'Sensitive directory access' },
    { pattern: /\/\.aws\//, name: 'AWS directory', desc: 'Cloud credential directory' },
    { pattern: /keychain/i, name: 'Keychain', desc: 'System keychain' },
    { pattern: /credentials|token|secret|api[_-]?key/i, name: 'credential related', desc: 'Sensitive information' },
    { pattern: /cron|systemd|launchd/i, name: 'persistence mechanism', desc: 'Auto-start on boot' },
    { pattern: /setTimeout|setInterval.*eval/i, name: 'timer eval', desc: 'Dynamic execution' },

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill includes shell-based scanning scripts and explicit command usage examples, but the manifest declares no tool scope or allowed-tools. That creates an authorization and review gap: users or orchestration systems cannot reliably understand that shell execution is required before activating the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation guidance is broad enough to trigger on many ordinary review or installation-related tasks. Overbroad invocation increases the chance the skill runs unnecessarily, potentially causing excessive shell and network activity and normalizing automated execution of untrusted-content scans without clear scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'When to Use' section uses ambiguous conditions like evaluating unknown code or periodic audits, which can overlap with many benign workflows. In a skill that recommends shell commands and repository fetching, ambiguous scope increases operational risk and accidental use against sensitive or unrelated content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
────────────────────────────────────────────────────────────

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill provides commands that contact external services such as GitHub and ClawHub to download or inspect remote content. Even if intended for vetting, external transmission can disclose user interests, repository targets, and environment metadata, and it expands attack surface to untrusted remote sources.

Content

Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.

rm -rf skill.zip SKILL_NAME

Method 2: GitHub repo scan

curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, updated: .updated_at}' git clone https://github.com/OWNER/REPO node ~/.npm-global/lib/node_modules/openclaw/skills/360guard/scripts/scanner.cjs ./REPO

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This command queries the GitHub API, which is an external network transmission. In context it is meant for reputation and metadata checks, but it still creates privacy and supply-chain exposure if run automatically or against attacker-controlled repositories.

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

bash
# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars, forks, updated, language}'

# List all files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/" | jq '.[].name'

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Fetching repository contents and raw SKILL.md from GitHub performs external network access to untrusted remote content. For a security-review skill, this is contextually expected, but still dangerous if automatic because remote responses may be malicious, misleading, or privacy-sensitive.

Content

Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.

md
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars, forks, updated, language}'

# List all files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/" | jq '.[].name'

# Get SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/SKILL.md"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The user-facing report strings are entirely in English, including conclusions and warnings, and the file provides no option to select locale or language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script creates a report file inside the user-supplied target directory, which modifies the scanned path as a side effect. This is risky because users may expect a scan to be read-only, and writing into an untrusted or sensitive path can overwrite expectations, leak scan metadata into repositories, or fail unexpectedly on protected locations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/scanner.cjs:16

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/full-scan.sh:26

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/scanner.cjs:15

Shell script base64-encodes a local file and sends it over the network.

Critical
Code
suspicious.potential_exfiltration
Location
scripts/quick-scan.sh:23