# Send Moltcops to your agent Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually. ## Fast path - Download the package from Yavira. - Extract it into a folder your agent can access. - Paste one of the prompts below and point your agent at the extracted folder. ## Suggested prompts ### New install ```text I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete. ``` ### Upgrade existing ```text I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run. ``` ## Machine-readable fields ```json { "schemaVersion": "1.0", "item": { "slug": "moltcops", "name": "Moltcops", "source": "tencent", "type": "skill", "category": "安全合规", "sourceUrl": "https://clawhub.ai/Adamthompson33/moltcops", "canonicalUrl": "https://clawhub.ai/Adamthompson33/moltcops", "targetPlatform": "OpenClaw" }, "install": { "downloadUrl": "/downloads/moltcops", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=moltcops", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "packageFormat": "ZIP package", "primaryDoc": "SKILL.md", "includedAssets": [ "rules.json", "scripts/scan.py", "SKILL.md", "_meta.json" ], "downloadMode": "redirect", "sourceHealth": { "source": "tencent", "slug": "moltcops", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-04-29T08:38:56.757Z", "expiresAt": "2026-05-06T08:38:56.757Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=moltcops", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=moltcops", "contentDisposition": "attachment; filename=\"moltcops-1.1.0.zip\"", "redirectLocation": null, "bodySnippet": null, "slug": "moltcops" }, "scope": "item", "summary": "Item download looks usable.", "detail": "Yavira can redirect you to the upstream package for this item.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/moltcops" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] } }, "links": { "detailUrl": "https://openagent3.xyz/skills/moltcops", "downloadUrl": "https://openagent3.xyz/downloads/moltcops", "agentUrl": "https://openagent3.xyz/skills/moltcops/agent", "manifestUrl": "https://openagent3.xyz/skills/moltcops/agent.json", "briefUrl": "https://openagent3.xyz/skills/moltcops/agent.md" } } ``` ## Documentation ### MoltCops — Skill Security Scanner Scan any skill for security threats before you install it. Detects prompt injection, data exfiltration, sleeper triggers, drain patterns, and 16 more threat categories. Local-first. Your code never leaves your machine. No API calls. No uploads. No accounts. ### When to Use Before installing any skill from ClawHub, GitHub, or other sources Before running skills shared by other agents When evaluating unknown code from any source After ClawHavoc: 341 malicious skills were found on ClawHub this week. Scan first. ### How to Run python3 scripts/scan.py Example: # Scan a skill before installing python3 scripts/scan.py ~/.openclaw/skills/suspicious-skill # Scan a freshly downloaded skill python3 scripts/scan.py ./my-new-skill No dependencies required — uses only Python 3 standard library. ### Reading Results The scanner returns three verdicts: VerdictExit CodeMeaningPASS0No critical or high-risk threats detected. Safe to install.WARN1High-risk patterns found. Review findings before installing.BLOCK2Critical threats detected. Do NOT install this skill. ### What It Detects 20 detection rules across these threat categories: CategoryRulesExamplesPrompt InjectionMC-001, MC-002, MC-003System prompt override, jailbreak payloads, tool-use steeringCode InjectionMC-004, MC-005, MC-006, MC-019Shell injection, eval/exec, base64-to-exec, child_processData ExfiltrationMC-007, MC-008, MC-009, MC-010, MC-020Webhook URLs, env var harvesting, SSH key access, credential filesHardcoded SecretsMC-011, MC-012API keys in source, private key materialFinancialMC-013Drain patterns, unlimited withdrawalsLateral MovementMC-014Git credential access, repo manipulationPersistenceMC-015, MC-016SOUL.md writes, cron job creationAutonomy AbuseMC-017Destructive force flags (rm -rf, git push --force)InfrastructureMC-018Permission escalation (sudo, chmod 777) ### False Positive Handling The scanner includes context-aware filtering to reduce false positives: Env var access (MC-008): Only flags when variable names contain KEY, SECRET, PASSWORD, TOKEN, or CREDENTIAL Git operations (MC-014): Skips standard remotes (github.com, gitlab.com, bitbucket.org) Force flags (MC-017): Only flags on destructive operations, not install scripts ### Example Output MoltCops Security Scanner ======================================== Scanning: ./suspicious-skill Files: 5 Rules: 20 FINDINGS ---------------------------------------- [CRITICAL] MC-007: Exfiltration URL (main.py:14) [CRITICAL] MC-004: Shell Injection (helper.sh:8) [HIGH] MC-005: Dynamic Code Execution (main.py:22) SUMMARY ======================================== Files scanned: 5 Total findings: 3 Critical: 2 High: 1 Medium: 0 VERDICT: BLOCK Critical threats detected. Do NOT install this skill. ### Web Scanner For a browser-based version with the same engine, visit: https://scan.moltcops.com ### About MoltCops MoltCops protects the AI agent ecosystem from malicious skills. While VirusTotal catches known malware signatures, MoltCops catches behavioral patterns — drain logic, sleeper triggers, prompt injection, and data exfiltration that signature-based scanning misses. Web: https://moltcops.com Moltbook: https://moltbook.com/u/MoltCops ## Trust - Source: tencent - Verification: Indexed source record - Publisher: Adamthompson33 - Version: 1.1.0 ## Source health - Status: healthy - Item download looks usable. - Yavira can redirect you to the upstream package for this item. - Health scope: item - Reason: direct_download_ok - Checked at: 2026-04-29T08:38:56.757Z - Expires at: 2026-05-06T08:38:56.757Z - Recommended action: Download for OpenClaw ## Links - [Detail page](https://openagent3.xyz/skills/moltcops) - [Send to Agent page](https://openagent3.xyz/skills/moltcops/agent) - [JSON manifest](https://openagent3.xyz/skills/moltcops/agent.json) - [Markdown brief](https://openagent3.xyz/skills/moltcops/agent.md) - [Download page](https://openagent3.xyz/downloads/moltcops)