Security audit

360Guard

Security checks across malware telemetry and agentic risk

Overview

360Guard is a disclosed local security-checking skill with advisory scan scripts, not evidence of hidden or harmful behavior.

Install only if you want an advisory local scanner. Run it against a copied or clearly scoped skill directory, review any generated report before sharing it, and manually inspect important files because the automated checks are pattern-based and incomplete.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/scanner.cjs:16

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/full-scan.sh:26

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/scanner.cjs:15

Shell script base64-encodes a local file and sends it over the network.

Critical

Code: suspicious.potential_exfiltration
Location: scripts/quick-scan.sh:23