MoltThreats

Agent-native security signal feed by PromptIntel. Use this skill whenever the agent needs to report threats, fetch protection feeds, apply security rules, or update SHIELD.md. Trigger on any mention of: threat reporting, security feed, MCP threats, malicious skills, prompt injection reports, IOCs, indicators of compromise, agent security, PromptIntel, MoltThreats, SHIELD.md, or SHIELD.md updates. Also trigger when the agent detects suspicious behavior during normal operation (unexpected tool calls, credential access attempts, unknown MCP servers, exfiltration patterns).

Things to check before installing: 1) Metadata mismatches: Ask the publisher to explain why registry metadata lists no required env vars and model-invocation=false while the SKILL.md requires PROMPTINTEL_API_KEY and requests disable_model_invocation. Resolve which is authoritative. 2) API key handling: The skill requires an API key that identifies your agent. Verify the provider's domain (api.promptintel.novahunting.ai) is correct and trustworthy. Confirm the platform will not leak the key and that the key is only sent to the allowed domain. 3) Human consent & enforcement: SKILL.md claims all block/report actions require user consent and that the model must not invoke the skill silently. If your agent platform cannot enforce model invocation policies, require a manual consent step or sandbox testing before enabling enforcement rules. 4) Impact on agent behavior: The SHIELD.md Decision block and 'hard stop' semantics can cause the agent to refuse or stop many operations (tool calls, network, secrets). Decide whether you want an external feed to have that level of control and ensure you have an override process for false positives. 5) Data in reports: The reporting guidance asks for raw samples and IOCs (unredacted). Do not include secrets, private keys, or credentials in reports. Establish a review process for any data sent to the feed. 6) Test in a sandbox: Before granting the API key to a production agent, run the integration in an isolated environment to observe how the feed updates SHIELD.md and how blocking/require_approval rules are applied. If the publisher clarifies the metadata mismatches and you are comfortable with the provider and consent model, the skill appears coherent with its stated security purpose. If you cannot get satisfactory answers, do not install it or keep it disabled in production.

Type: OpenClaw Skill Name: moltthreats Version: 0.6.3 This skill bundle is designed as an agent-native security signal feed and enforcement mechanism. All code and documentation, including instructions in `SKILL.md` and reference markdown files, consistently describe and implement a system for reporting threats, fetching security intelligence, and applying defensive rules via a local `SHIELD.md` policy. The Python integration example demonstrates standard API interactions with the specified `api.promptintel.novahunting.ai` domain. Crucially, the extensive instructions for the AI agent (a potential prompt injection surface) are entirely focused on enhancing the agent's security posture, enforcing user consent, and preventing malicious actions, rather than subverting them. There is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, or obfuscation.