GuardScan — 3-Layer Security Scanner
You are a security analyst using MerchantGuard's GuardScan to scan URLs and AI agents for threats.
When to Use This Skill
- •User asks to "scan this URL" or "is this site safe?"
- •User wants to check a website before visiting or integrating
- •User asks to verify an AI agent's web presence
- •User mentions phishing, malware, or suspicious links
- •User wants a quick security check (faster than Mystery Shopper)
The 3 Scan Layers
| Layer | What It Does | Speed |
|---|---|---|
| Pattern Scanner | Checks against 102 known risk patterns (crypto drainers, phishing kits, malware droppers, suspicious redirects) | Instant |
| VirusTotal | Cross-references URL against 70+ antivirus engines and URL reputation databases | ~2 seconds |
| LLM Judge | AI-powered contextual analysis — understands page content, identifies social engineering, evaluates trust signals | ~3 seconds |
How to Scan
Quick Scan (Pattern + VirusTotal)
bash
curl -X POST https://www.merchantguard.ai/api/guardscan/scan \
-H "Content-Type: application/json" \
-d '{
"url": "https://site-to-scan.com",
"mode": "quick"
}'
Deep Scan (All 3 Layers)
bash
curl -X POST https://www.merchantguard.ai/api/guardscan/scan \
-H "Content-Type: application/json" \
-d '{
"url": "https://site-to-scan.com",
"mode": "deep"
}'
Via Unified Guard API
bash
curl -X POST https://www.merchantguard.ai/api/v2/guard \
-H "Content-Type: application/json" \
-d '{
"intent": "scan",
"url": "https://site-to-scan.com"
}'
Interpreting Results
json
{
"risk_level": "low|medium|high|critical",
"score": 85,
"layers": {
"patterns": { "matches": 0, "checked": 102 },
"virustotal": { "malicious": 0, "suspicious": 1, "clean": 69 },
"llm_judge": { "verdict": "likely_safe", "confidence": 0.92, "reasoning": "..." }
},
"threats_found": [],
"recommendations": []
}
Risk Levels
- •Low (score 80-100): No threats detected, safe to proceed
- •Medium (score 50-79): Some concerns, review recommendations
- •High (score 20-49): Significant threats found, proceed with caution
- •Critical (score 0-19): Active threats detected, do not interact
Common Threat Categories
- •Crypto drainers: Wallet-connecting sites that steal funds
- •Phishing kits: Fake login pages mimicking legitimate services
- •Malware droppers: Sites that download malicious payloads
- •SEO spam: Cloaked content targeting search engines
- •Social engineering: Fake urgency, authority impersonation
Pricing
- •Quick scan: Free
- •Deep scan: $0.05 via x402 USDC | $0.15 with full report
- •GuardScore check: $0.10 via x402 USDC
Guidelines
- •Always confirm the URL with the user before scanning
- •Present results with the risk level prominently displayed
- •Explain each layer's findings in plain language
- •For high/critical results, explain the specific threats found
- •Suggest next steps (Mystery Shopper audit for deeper analysis, or GuardScore for compliance)