360Guard

1# 360Guard 🛡️
2 
3> 360-degree comprehensive security review — Like antivirus for your Skills
4 
5## 1. When to Use
6 
7- Before installing any Skill from ClawHub
8- Before installing any Skill from GitHub or other sources
9- When evaluating code shared by other Agents
10- Any time you're asked to install unknown code
11- Periodic audit of installed Skills (recommended monthly)
12- Before running high-risk Skills for second verification
13 
14## 2. Core Principles
15 
16```
17┌─────────────────────────────────────────────────────────────┐
18│  🛑 Security Layer Priority                                 │
19├─────────────────────────────────────────────────────────────┤
20│  ⛔ EXTREME → Absolutely refuse to install                  │
21│  🔴 HIGH    → Requires human approval                       │
22│  🟡 MEDIUM  → Full code review + limited permissions        │
23│  🟢 LOW     → Basic review OK                               │
24└─────────────────────────────────────────────────────────────┘
25```
26 
27## 3. Security Checklist
28 
29### 3.1 Base Red Flags (from Skill Vetter)
30 
31```
32🚨 Reject immediately if you see:
33────────────────────────────────────────────────────────────
34• curl/wget to unknown URLs
35• Sends data to external servers
36• Requests credentials/tokens/API keys
37• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
38• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
39• Uses base64 decode on anything
40• Uses eval() or exec() with external input
41• Modifies system files outside workspace
42…