Moltcops Skill

Pre-install security scanner for AI agent skills. Detects malicious patterns before you trust code. Local-first — code never leaves your machine.

This package appears internally consistent with its stated purpose. Before trusting it: (1) manually open scripts/scan.py and rules.json and search for any network or subprocess calls (e.g., requests, urllib, socket, subprocess, os.system, urllib3, httpx) or hardcoded URLs/endpoints — the SKILL.md claims 'No API calls' and that should be verified; (2) confirm the script does not POST/PUT/GET scanned file contents to remote servers; (3) run the scanner on a harmless test folder first to observe behavior and any network activity (use a network monitor or run offline); (4) inspect rules.json to understand what is flagged and whether it may produce false positives on your code. If you cannot or do not want to inspect the code yourself, treat the skill as untrusted until a third party you trust has audited scripts/scan.py.

Type: OpenClaw Skill Name: moltcops-skill Version: 1.0.0 This skill bundle, 'MoltCops', is a security scanner designed to detect malicious patterns in other AI agent skills. The `SKILL.md` clearly outlines its purpose, emphasizing local-first operation with no network calls. The `scripts/scan.py` implements this functionality by reading files and applying regex patterns defined in `rules.json`. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts by this skill itself. All code and documentation align with the stated purpose of a security analysis tool.