Moltcops

Pre-install security scanner for AI agent skills. Detects malicious patterns before you trust code. Local-first — code never leaves your machine.

Moltcops appears to be what it claims: a small, local file-pattern scanner. Before running it: 1) review rules.json if you want to see what patterns will be flagged (and to tune noisy rules); 2) test the scanner on a non-sensitive folder first so you understand its output format; 3) avoid pointing it at directories containing unencrypted private keys or credentials you don't want printed to stdout (it will show matched line snippets locally); 4) treat the advertised web links as external resources — the script doesn't call them, but verify those sites yourself before visiting; and 5) if you need stronger privacy, run the script inside a sandbox or container and redirect output to a secure location. Overall the skill is coherent and low-risk for its intended purpose.

Type: OpenClaw Skill Name: moltcops Version: 1.1.0 The OpenClaw skill 'moltcops' is a security scanner designed to detect malicious patterns in other AI agent skills. The `SKILL.md` documentation clearly outlines its purpose, local-first operation, and the types of threats it identifies, with no evidence of prompt injection against the agent. The `scripts/scan.py` code implements the scanner as described, performing static analysis by reading files and applying regex rules from `rules.json` without making network calls, modifying files, or executing untrusted code. The `rules.json` file contains legitimate patterns for detecting various security threats like data exfiltration, code injection, and persistence mechanisms in *other* skills. All components align with the stated purpose of a security tool and exhibit no malicious intent or risky behavior themselves.