MoltCops — Skill Security Scanner
Scan any skill for security threats before you install it. Detects prompt injection, data exfiltration, sleeper triggers, drain patterns, and 16 more threat categories.
Local-first. Your code never leaves your machine. No API calls. No uploads. No accounts.
When to Use
- - Before installing any skill from ClawHub, GitHub, or other sources
- Before running skills shared by other agents
- When evaluating unknown code from any source
- After ClawHavoc: 341 malicious skills were found on ClawHub this week. Scan first.
How to Run
CODEBLOCK0
Example:
CODEBLOCK1
No dependencies required — uses only Python 3 standard library.
Reading Results
The scanner returns three verdicts:
| Verdict | Exit Code | Meaning |
|---|
| PASS | 0 | No critical or high-risk threats detected. Safe to install. |
| WARN |
1 | High-risk patterns found. Review findings before installing. |
|
BLOCK | 2 | Critical threats detected. Do NOT install this skill. |
What It Detects
20 detection rules across these threat categories:
| Category | Rules | Examples |
|---|
| Prompt Injection | MC-001, MC-002, MC-003 | System prompt override, jailbreak payloads, tool-use steering |
| Code Injection |
MC-004, MC-005, MC-006, MC-019 | Shell injection, eval/exec, base64-to-exec, child_process |
|
Data Exfiltration | MC-007, MC-008, MC-009, MC-010, MC-020 | Webhook URLs, env var harvesting, SSH key access, credential files |
|
Hardcoded Secrets | MC-011, MC-012 | API keys in source, private key material |
|
Financial | MC-013 | Drain patterns, unlimited withdrawals |
|
Lateral Movement | MC-014 | Git credential access, repo manipulation |
|
Persistence | MC-015, MC-016 | SOUL.md writes, cron job creation |
|
Autonomy Abuse | MC-017 | Destructive force flags (rm -rf, git push --force) |
|
Infrastructure | MC-018 | Permission escalation (sudo, chmod 777) |
False Positive Handling
The scanner includes context-aware filtering to reduce false positives:
- - Env var access (MC-008): Only flags when variable names contain KEY, SECRET, PASSWORD, TOKEN, or CREDENTIAL
- Git operations (MC-014): Skips standard remotes (github.com, gitlab.com, bitbucket.org)
- Force flags (MC-017): Only flags on destructive operations, not install scripts
Example Output
CODEBLOCK2
Web Scanner
For a browser-based version with the same engine, visit: https://scan.moltcops.com
About MoltCops
MoltCops protects the AI agent ecosystem from malicious skills. While VirusTotal catches known malware signatures, MoltCops catches behavioral patterns — drain logic, sleeper triggers, prompt injection, and data exfiltration that signature-based scanning misses.
- - Web: https://moltcops.com
- Moltbook: https://moltbook.com/u/MoltCops
MoltCops — 技能安全扫描器
在安装任何技能之前，扫描其安全威胁。可检测提示注入、数据窃取、休眠触发器、资金抽干模式及另外16种威胁类别。
本地优先。 你的代码永远不会离开你的机器。无需API调用。无需上传。无需账户。
使用场景
- - 安装来自ClawHub、GitHub或其他来源的任何技能之前
- 运行其他代理共享的技能之前
- 评估来自任何来源的未知代码时
- ClawHavoc事件后：本周在ClawHub上发现341个恶意技能。先扫描再安装。
运行方式
bash
python3 scripts/scan.py <技能文件夹路径>
示例：
bash
安装前扫描技能
python3 scripts/scan.py ~/.openclaw/skills/suspicious-skill
扫描刚下载的技能
python3 scripts/scan.py ./my-new-skill
无需依赖 — 仅使用Python 3标准库。
结果解读
扫描器返回三种判定结果：
| 判定结果 | 退出码 | 含义 |
|---|
| 通过 | 0 | 未检测到严重或高风险威胁。可安全安装。 |
| 警告 |
1 | 发现高风险模式。安装前请审查结果。 |
|
阻止 | 2 | 检测到严重威胁。请勿安装此技能。 |
检测内容
涵盖以下威胁类别的20条检测规则：
| 类别 | 规则 | 示例 |
|---|
| 提示注入 | MC-001, MC-002, MC-003 | 系统提示覆盖、越狱载荷、工具使用操控 |
| 代码注入 |
MC-004, MC-005, MC-006, MC-019 | Shell注入、eval/exec、base64转执行、子进程 |
|
数据窃取 | MC-007, MC-008, MC-009, MC-010, MC-020 | Webhook URL、环境变量窃取、SSH密钥访问、凭据文件 |
|
硬编码密钥 | MC-011, MC-012 | 源码中的API密钥、私钥材料 |
|
金融风险 | MC-013 | 资金抽干模式、无限提现 |
|
横向移动 | MC-014 | Git凭据访问、仓库操控 |
|
持久化 | MC-015, MC-016 | SOUL.md写入、创建定时任务 |
|
自主权滥用 | MC-017 | 破坏性强制标志（rm -rf、git push --force） |
|
基础设施 | MC-018 | 权限提升（sudo、chmod 777） |
误报处理
扫描器包含上下文感知过滤以减少误报：
- - 环境变量访问（MC-008）：仅当变量名包含KEY、SECRET、PASSWORD、TOKEN或CREDENTIAL时触发
- Git操作（MC-014）：跳过标准远程仓库（github.com、gitlab.com、bitbucket.org）
- 强制标志（MC-017）：仅对破坏性操作触发，不检测安装脚本
输出示例
MoltCops 安全扫描器
========================================
正在扫描: ./suspicious-skill
文件数: 5
规则数: 20
检测结果
[严重] MC-007: 数据窃取URL (main.py:14)
[严重] MC-004: Shell注入 (helper.sh:8)
[高危] MC-005: 动态代码执行 (main.py:22)
汇总
========================================
扫描文件数: 5
总发现数: 3
严重: 2
高危: 1
中危: 0
判定结果: 阻止
检测到严重威胁。请勿安装此技能。
网页版扫描器
如需使用相同引擎的浏览器版本，请访问：https://scan.moltcops.com
关于MoltCops
MoltCops保护AI代理生态系统免受恶意技能侵害。VirusTotal捕获已知恶意软件签名，而MoltCops捕获行为模式——签名扫描无法发现的抽干逻辑、休眠触发器、提示注入和数据窃取。
- - 网站：https://moltcops.com
- Moltbook：https://moltbook.com/u/MoltCops
