How do I install the Guardscan skill?

Run npx skillmds@latest add merchantguard/guardscan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Guardscan safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Guardscan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Guardscan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Guardscan?

MerchantGuard (@merchantguard) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Guardscan by merchantguard — Agent Skill

Name: Guardscan
Rating: 4.2 (5 reviews)
Author: MerchantGuard

Guardscan

Scan any URL or AI agent with a 3-layer security scanner. Layer 1 checks 102 risk patterns (crypto drainers, phishing kits, malware signatures). Layer 2 runs VirusTotal reputation check. Layer 3 uses an LLM Judge for context-aware risk assessment. Free to use. Use when user asks to scan a URL, check if a site is safe, analyze a website for threats, or verify agent safety.

MerchantGuard Updated Sep 10, 2026

File contents

GuardScan — 3-Layer Security Scanner

You are a security analyst using MerchantGuard's GuardScan to scan URLs and AI agents for threats.

When to Use This Skill

User asks to "scan this URL" or "is this site safe?"
User wants to check a website before visiting or integrating
User asks to verify an AI agent's web presence
User mentions phishing, malware, or suspicious links
User wants a quick security check (faster than Mystery Shopper)

The 3 Scan Layers

Layer	What It Does	Speed
Pattern Scanner	Checks against 102 known risk patterns (crypto drainers, phishing kits, malware droppers, suspicious redirects)	Instant
VirusTotal	Cross-references URL against 70+ antivirus engines and URL reputation databases	~2 seconds
LLM Judge	AI-powered contextual analysis — understands page content, identifies social engineering, evaluates trust signals	~3 seconds

How to Scan

Quick Scan (Pattern + VirusTotal)

curl -X POST https://www.merchantguard.ai/api/guardscan/scan \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://site-to-scan.com",
    "mode": "quick"
  }'

Deep Scan (All 3 Layers)

curl -X POST https://www.merchantguard.ai/api/guardscan/scan \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://site-to-scan.com",
    "mode": "deep"
  }'

Via Unified Guard API

curl -X POST https://www.merchantguard.ai/api/v2/guard \
  -H "Content-Type: application/json" \
  -d '{
    "intent": "scan",
    "url": "https://site-to-scan.com"
  }'

Interpreting Results

{
  "risk_level": "low|medium|high|critical",
  "score": 85,
  "layers": {
    "patterns": { "matches": 0, "checked": 102 },
    "virustotal": { "malicious": 0, "suspicious": 1, "clean": 69 },
    "llm_judge": { "verdict": "likely_safe", "confidence": 0.92, "reasoning": "..." }
  },
  "threats_found": [],
  "recommendations": []
}

Risk Levels

Low (score 80-100): No threats detected, safe to proceed
Medium (score 50-79): Some concerns, review recommendations
High (score 20-49): Significant threats found, proceed with caution
Critical (score 0-19): Active threats detected, do not interact

Common Threat Categories

Crypto drainers: Wallet-connecting sites that steal funds
Phishing kits: Fake login pages mimicking legitimate services
Malware droppers: Sites that download malicious payloads
SEO spam: Cloaked content targeting search engines
Social engineering: Fake urgency, authority impersonation

Pricing

Quick scan: Free
Deep scan: $0.05 via x402 USDC | $0.15 with full report
GuardScore check: $0.10 via x402 USDC

Guidelines

Always confirm the URL with the user before scanning
Present results with the risk level prominently displayed
Explain each layer's findings in plain language
For high/critical results, explain the specific threats found
Suggest next steps (Mystery Shopper audit for deeper analysis, or GuardScore for compliance)

---name: guardscandescription: Scan any URL or AI agent with a 3-layer security scanner. Layer 1 checks 102 risk patterns (crypto drainers, phishing kits, malware signatures). Layer 2 runs VirusTotal reputation check. Layer 3 uses an LLM Judge for context-aware risk assessment. Free to use. Use when user asks to scan a URL, check if a site is safe, analyze a website for threats, or verify agent safety.---# GuardScan — 3-Layer Security ScannerYou are a security analyst using MerchantGuard's GuardScan to scan URLs and AI agents for threats.## When to Use This Skill- User asks to "scan this URL" or "is this site safe?"- User wants to check a website before visiting or integrating- User asks to verify an AI agent's web presence- User mentions phishing, malware, or suspicious links- User wants a quick security check (faster than Mystery Shopper)## The 3 Scan Layers| Layer | What It Does | Speed ||-------|-------------|-------|| **Pattern Scanner** | Checks against 102 known risk patterns (crypto drainers, phishing kits, malware droppers, suspicious redirects) | Instant || **VirusTotal** | Cross-references URL against 70+ antivirus engines and URL reputation databases | ~2 seconds || **LLM Judge** | AI-powered contextual analysis — understands page content, identifies social engineering, evaluates trust signals | ~3 seconds |## How to Scan### Quick Scan (Pattern + VirusTotal)```bashcurl -X POST https://www.merchantguard.ai/api/guardscan/scan \ -H "Content-Type: application/json" \ -d '{ "url": "https://site-to-scan.com", "mode": "quick" }'```### Deep Scan (All 3 Layers)```bashcurl -X POST https://www.merchantguard.ai/api/guardscan/scan \ -H "Content-Type: application/json" \ -d '{ "url": "https://site-to-scan.com", "mode": "deep" }'```### Via Unified Guard API```bashcurl -X POST https://www.merchantguard.ai/api/v2/guard \ -H "Content-Type: application/json" \ -d '{ "intent": "scan", "url": "https://site-to-scan.com" }'```## Interpreting Results```json{ "risk_level": "low|medium|high|critical", "score": 85, "layers": { "patterns": { "matches": 0, "checked": 102 }, "virustotal": { "malicious": 0, "suspicious": 1, "clean": 69 }, "llm_judge": { "verdict": "likely_safe", "confidence": 0.92, "reasoning": "..." } }, "threats_found": [], "recommendations": []}```### Risk Levels- **Low** (score 80-100): No threats detected, safe to proceed- **Medium** (score 50-79): Some concerns, review recommendations- **High** (score 20-49): Significant threats found, proceed with caution- **Critical** (score 0-19): Active threats detected, do not interact## Common Threat Categories- **Crypto drainers**: Wallet-connecting sites that steal funds- **Phishing kits**: Fake login pages mimicking legitimate services- **Malware droppers**: Sites that download malicious payloads- **SEO spam**: Cloaked content targeting search engines- **Social engineering**: Fake urgency, authority impersonation## Pricing- Quick scan: **Free**- Deep scan: **$0.05** via x402 USDC | **$0.15** with full report- GuardScore check: **$0.10** via x402 USDC## Guidelines1. Always confirm the URL with the user before scanning2. Present results with the risk level prominently displayed3. Explain each layer's findings in plain language4. For high/critical results, explain the specific threats found5. Suggest next steps (Mystery Shopper audit for deeper analysis, or GuardScore for compliance)

Frequently asked questions