---

name: 360Guard description: 360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks and automated scanning scripts. Supports static analysis, behavior detection, dependency auditing.

360Guard 🛡️

360-degree comprehensive security review — Like antivirus for your Skills

1. When to Use

• Before installing any Skill from ClawHub
• Before installing any Skill from GitHub or other sources
• When evaluating code shared by other Agents
• Any time you're asked to install unknown code
• Periodic audit of installed Skills (recommended monthly)
• Before running high-risk Skills for second verification

2. Core Principles

┌─────────────────────────────────────────────────────────────┐
│  🛑 Security Layer Priority                                 │
├─────────────────────────────────────────────────────────────┤
│  ⛔ EXTREME → Absolutely refuse to install                  │
│  🔴 HIGH    → Requires human approval                       │
│  🟡 MEDIUM  → Full code review + limited permissions        │
│  🟢 LOW     → Basic review OK                               │
└─────────────────────────────────────────────────────────────┘

3. Security Checklist

3.1 Base Red Flags (from Skill Vetter)

🚨 Reject immediately if you see:
────────────────────────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
────────────────────────────────────────────────────────────

3.2 Extended Red Flags (New)

3.2.1 Persistence & Auto-start

🔴 Persistence check:
• Creates cron job / systemd service
• Modifies ~/.ssh/authorized_keys
• Writes to /etc/hosts
• Adds Login Items / Startup Items
• Modifies .bashrc / .zshrc / profile
• Registers LaunchAgent (macOS)
• Installs systemd user service

3.2.2 Monitoring & Eavesdropping

🔴 Monitoring permissions check:
• Requests screen capture/recording (screencapture)
• Requests audio recording permission
• Keyloggers
• Accesses microphone/camera
• File system monitoring (fswatch/inotify)

3.2.3 Data & Privacy

🔴 Data theft check:
• Reads clipboard (pbpaste)
• Reads environment variables (especially API_, SECRET, TOKEN)
• Accesses browser history/bookmarks
• Accesses macOS Keychain
• Accesses iMessage/SMS
• Accesses contacts/calendar
• Accesses photo library

3.2.4 Network & Communication

🔴 Network anomaly check:
• Initiates reverse shell (nc -e / bash -i)
• Uses Tor proxy
• DNS queries to suspicious domains
• WebSocket long connections
• IRC connections
• Non-standard ports (>65535 or <1024 unusual)
• Hardcoded IP addresses (non-local)

3.2.5 Code Execution (Advanced)

🔴 Dynamic execution check:
• Dynamic import (importlib.import_module)
• __import__() dynamic loading
• compile() dynamic compilation
• xmlrpc / jsonrpc remote calls
• pickle / yaml / marshal deserialization
• exec() / eval() any string
• subprocess shell=True

3.2.6 File System

🟡 File operation check:
• Writes to executable paths outside /tmp
• Modifies /usr/local/bin
• Writes .dmg/.pkg installers
• Creates .hidden files/directories
• File permission modification (chmod +x)
• Symbolic links (pointing external)
• Contains binary files (.so/.dylib/.exe/.bin)

3.2.7 Dependencies & Supply Chain

🟡 Supply chain check:
• Dependency version range too wide (>1.0.0 not ^1.0.0)
• Dependencies from private/unknown sources
• Dependencies on deprecated packages
• Silent additional dependency downloads
• References other unvetted Skills
• Uses git submodule (may point to malicious repo)

3.2.8 Social Engineering

🟡 Social engineering check:
• Mimics popular Skill names (e.g., "github", "weather-ai")
• README overpromises ("one-click to do everything...")
• No source code, only compiled binaries
• Author has no history
• Downloads vs stars ratio suspicious (fake reviews)

---

4. Risk Classification

| Risk Level | Example Checks | Action | |------------|----------------|--------| | 🟢 LOW | Text processing, weather, note formatting | Basic review, OK to install | | 🟡 MEDIUM | File I/O, browser control, API calls | Full review + limited permissions | | 🔴 HIGH | Credential access, Keychain, network requests | Human approval + sandbox test | | ⛔ EXTREME | Persistence, root access, keylogging, reverse shell | Refuse |

---

5. Trust Hierarchy

| Source | Review Level | Recommendation | |--------|--------------|----------------| | Official OpenClaw Skills | Low (still review) | Basic check | | High-star Repo (1000+) | Medium | Standard check | | Known Authors | Medium | Standard check | | Unknown Sources | High | Full check | | Requests credentials | Extreme | Refuse | | Modifies system files | Extreme | Refuse |

---

6. Automated Scanning Scripts

6.1 Quick Scan (quick-scan.sh)

#!/bin/bash
# Usage: ./quick-scan.sh /path/to/skill
# Output: Quick risk assessment report

SKILL_PATH=$1
echo "🔍 360Guard Quick Scan: $SKILL_PATH"
echo "================================"

# Check dangerous functions
echo -e "\n📡 Network request check:"
grep -r "curl\|wget\|fetch\|http\.\|https\.\|socket" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" | head -5

# Check sensitive file access
echo -e "\n🔑 Sensitive path check:"
grep -r "~/.ssh\|~/.aws\|~/.config\|/etc/hosts\|authorized_keys" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py"

# Check dangerous commands
echo -e "\n⚠️ Dangerous command check:"
grep -r "eval\|exec\|shell=True\|base64 -d\|openssl" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py"

echo -e "\n✅ Quick scan complete"

6.2 Full Scan (full-scan.sh)

#!/bin/bash
# Usage: ./full-scan.sh /path/to/skill
# Output: Complete security assessment report

SKILL_PATH=$1
REPORT="$SKILL_PATH/360guard-report.txt"

echo "🛡️ 360Guard Full Scan: $SKILL_PATH" | tee "$REPORT"
echo "========================================" | tee -a "$REPORT"

# 1. File structure check
echo -e "\n📁 File structure:" | tee -a "$REPORT"
find "$SKILL_PATH" -type f | head -20 | tee -a "$REPORT"

# 2. Dangerous function scan
echo -e "\n⚠️ Dangerous function scan:" | tee -a "$REPORT"
for pattern in "eval(" "exec(" "shell=True" "base64" "subprocess" "importlib" "__import__" "pickle" "yaml.load" "xmlrpc" "socket.create_connection"; do
  result=$(grep -r "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  ❌ Found: $pattern" | tee -a "$REPORT"
    echo "$result" | head -3 | tee -a "$REPORT"
  fi
done

# 3. Sensitive path scan
echo -e "\n🔑 Sensitive path scan:" | tee -a "$REPORT"
for pattern in "~/.ssh" "~/.aws" "~/.config" "/etc/hosts" "authorized_keys" "keychain" "credentials" ".env"; do
  result=$(grep -r "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  ⚠️ Warning: $pattern" | tee -a "$REPORT"
  fi
done

# 4. Network request scan
echo -e "\n🌐 Network request scan:" | tee -a "$REPORT"
grep -r "http://\|https://\|wget\|curl\|fetch" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" | grep -v "^#" | head -10 | tee -a "$REPORT"

# 5. Persistence check
echo -e "\n⏰ Persistence check:" | tee -a "$REPORT"
for pattern in "cron" "systemd" "launchd" "login item" "startup" "autostart"; do
  result=$(grep -ri "$pattern" "$SKILL_PATH" --include="*.sh" --include="*.js" --include="*.py" 2>/dev/null)
  if [ -n "$result" ]; then
    echo "  🔴 High risk: $pattern" | tee -a "$REPORT"
  fi
done

# 6. Dependency check
echo -e "\n📦 Dependency check:" | tee -a "$REPORT"
if [ -f "$SKILL_PATH/package.json" ]; then
  cat "$SKILL_PATH/package.json" | grep -E "dependencies|devDependencies" -A 20 | tee -a "$REPORT"
fi
if [ -f "$SKILL_PATH/requirements.txt" ]; then
  cat "$SKILL_PATH/requirements.txt" | tee -a "$REPORT"
fi
if [ -f "$SKILL_PATH/package.yaml" ]; then
  cat "$SKILL_PATH/package.yaml" | tee -a "$REPORT"
fi

# 7. Binary file check
echo -e "\n💾 Binary file check:" | tee -a "$REPORT"
find "$SKILL_PATH" -type f \( -name "*.so" -o -name "*.dylib" -o -name "*.exe" -o -name "*.bin" -o -name "*.dll" \) 2>/dev/null | tee -a "$REPORT"

echo -e "\n========================================" | tee -a "$REPORT"
echo "✅ Full scan complete, report saved to: $REPORT"

6.3 Node.js Scanner (scanner.js)

#!/usr/bin/env node
/**
 * 360Guard Node.js Scanner
 * Usage: node scanner.js /path/to/skill
 */

const fs = require('fs');
const path = require('path');
const { execSync } = require('child_process');

const DANGER_PATTERNS = {
  CRITICAL: [
    { pattern: /eval\s*\(/, name: 'eval() execution' },
    { pattern: /exec\s*\(/, name: 'exec() execution' },
    { pattern: /shell\s*=\s*true/i, name: 'subprocess shell=True' },
    { pattern: /base64.*decode/i, name: 'base64 decode' },
    { pattern: /pickle\.load/i, name: 'pickle deserialization' },
    { pattern: /yaml\.load/i, name: 'yaml deserialization' },
    { pattern: /__import__\s*\(/, name: 'dynamic import' },
    { pattern: /importlib\.import_module/i, name: 'dynamic module load' },
    { pattern: /xmlrpc/i, name: 'XML-RPC remote call' },
    { pattern: /reverse.*shell|nc\s+-e|bash\s+-i/i, name: 'reverse shell' }
  ],
  HIGH: [
    { pattern: /curl\s+/, name: 'curl request' },
    { pattern: /wget\s+/, name: 'wget download' },
    { pattern: /fetch\s*\(/, name: 'fetch request' },
    { pattern: /https?:\/\/\d{1,3}\.\d{1,3}/, name: 'direct IP connection' },
    { pattern: /process\.env/i, name: 'environment variable access' },
    { pattern: /child_process/, name: 'subprocess execution' }
  ],
  MEDIUM: [
    { pattern: /\/\.ssh\//, name: 'SSH directory access' },
    { pattern: /\/\.aws\//, name: 'AWS directory access' },
    { pattern: /keychain/i, name: 'Keychain access' },
    { pattern: /credentials|token|secret/i, name: 'credential related' },
    { pattern: /cron|systemd|launchd/i, name: 'persistence mechanism' }
  ]
};

function scanFile(filePath) {
  const results = { CRITICAL: [], HIGH: [], MEDIUM: [] };
  
  try {
    const content = fs.readFileSync(filePath, 'utf8');
    
    for (const [level, patterns] of Object.entries(DANGER_PATTERNS)) {
      for (const { pattern, name } of patterns) {
        if (pattern.test(content)) {
          results[level].push({ file: filePath, issue: name });
        }
      }
    }
  } catch (e) {
    // Skip unreadable files
  }
  
  return results;
}

function scanDirectory(dirPath) {
  const allResults = { CRITICAL: [], HIGH: [], MEDIUM: [] };
  
  function walk(dir) {
    const files = fs.readdirSync(dir);
    for (const file of files) {
      const fullPath = path.join(dir, file);
      const stat = fs.statSync(fullPath);
      
      if (stat.isDirectory() && !file.startsWith('.')) {
        walk(fullPath);
      } else if (stat.isFile()) {
        const ext = path.extname(file);
        if (['.js', '.ts', '.py', '.sh', '.bash'].includes(ext)) {
          const results = scanFile(fullPath);
          for (const level of Object.keys(allResults)) {
            allResults[level].push(...results[level]);
          }
        }
      }
    }
  }
  
  walk(dirPath);
  return allResults;
}

function generateReport(skillPath, results) {
  console.log('\n🛡️