Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub · Security & Compliance
Moltcops
Pre-install security scanner for AI agent skills. Detects malicious patterns before you trust code. Local-first — code never leaves your machine.
skill openclawclawhub Free
Pre-install security scanner for AI agent skills. Detects malicious patterns before you trust code. Local-first — code never leaves your machine.
⬇ 0 downloads ★ 0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- rules.json, scripts/scan.py, SKILL.md, _meta.json
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.1.0
Provenance
- Publisher
- Adamthompson33
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
MoltCops — Skill Security Scanner
Scan any skill for security threats before you install it. Detects prompt injection, data exfiltration, sleeper triggers, drain patterns, and 16 more threat categories. Local-first. Your code never leaves your machine. No API calls. No uploads. No accounts.
When to Use
Before installing any skill from ClawHub, GitHub, or other sources Before running skills shared by other agents When evaluating unknown code from any source After ClawHavoc: 341 malicious skills were found on ClawHub this week. Scan first.
How to Run
python3 scripts/scan.py <path-to-skill-folder> Example: # Scan a skill before installing python3 scripts/scan.py ~/.openclaw/skills/suspicious-skill # Scan a freshly downloaded skill python3 scripts/scan.py ./my-new-skill No dependencies required — uses only Python 3 standard library.
Reading Results
The scanner returns three verdicts: VerdictExit CodeMeaningPASS0No critical or high-risk threats detected. Safe to install.WARN1High-risk patterns found. Review findings before installing.BLOCK2Critical threats detected. Do NOT install this skill.
What It Detects
20 detection rules across these threat categories: CategoryRulesExamplesPrompt InjectionMC-001, MC-002, MC-003System prompt override, jailbreak payloads, tool-use steeringCode InjectionMC-004, MC-005, MC-006, MC-019Shell injection, eval/exec, base64-to-exec, child_processData ExfiltrationMC-007, MC-008, MC-009, MC-010, MC-020Webhook URLs, env var harvesting, SSH key access, credential filesHardcoded SecretsMC-011, MC-012API keys in source, private key materialFinancialMC-013Drain patterns, unlimited withdrawalsLateral MovementMC-014Git credential access, repo manipulationPersistenceMC-015, MC-016SOUL.md writes, cron job creationAutonomy AbuseMC-017Destructive force flags (rm -rf, git push --force)InfrastructureMC-018Permission escalation (sudo, chmod 777)
False Positive Handling
The scanner includes context-aware filtering to reduce false positives: Env var access (MC-008): Only flags when variable names contain KEY, SECRET, PASSWORD, TOKEN, or CREDENTIAL Git operations (MC-014): Skips standard remotes (github.com, gitlab.com, bitbucket.org) Force flags (MC-017): Only flags on destructive operations, not install scripts
Example Output
MoltCops Security Scanner ======================================== Scanning: ./suspicious-skill Files: 5 Rules: 20 FINDINGS ---------------------------------------- [CRITICAL] MC-007: Exfiltration URL (main.py:14) [CRITICAL] MC-004: Shell Injection (helper.sh:8) [HIGH] MC-005: Dynamic Code Execution (main.py:22) SUMMARY ======================================== Files scanned: 5 Total findings: 3 Critical: 2 High: 1 Medium: 0 VERDICT: BLOCK Critical threats detected. Do NOT install this skill.
Web Scanner
For a browser-based version with the same engine, visit: https://scan.moltcops.com
About MoltCops
MoltCops protects the AI agent ecosystem from malicious skills. While VirusTotal catches known malware signatures, MoltCops catches behavioral patterns — drain logic, sleeper triggers, prompt injection, and data exfiltration that signature-based scanning misses. Web: https://moltcops.com Moltbook: https://moltbook.com/u/MoltCops
Category context
Identity, auth, scanning, governance, audit, and operational guardrails.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
2 Config1 Docs1 Scripts
- SKILL.md
- scripts/scan.py
- _meta.json
- rules.json