Moltcops

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.1.0

Overview

This local scanner is not trying to send data out, but it can be tricked by scanned folders into reading files outside the chosen folder.

Install only if you are comfortable running a local scanner on directories you choose. Until the symlink and file-size issues are fixed, avoid scanning untrusted extracted skills that may contain symlinks, or run the scanner inside a sandbox/container with limited filesystem access. Treat PASS as a triage signal, not a guarantee that a skill is safe.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan.py:72

Finding

Scan-Boundary Bypass Through Symbolic-Link File Traversal

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

| **Financial** | MC-013 | Drain patterns, unlimited withdrawals |
| **Lateral Movement** | MC-014 | Git credential access, repo manipulation |
| **Persistence** | MC-015, MC-016 | SOUL.md writes, cron job creation |
| **Autonomy Abuse** | MC-017 | Destructive force flags (rm -rf, git push --force) |
| **Infrastructure** | MC-018 | Permission escalation (sudo, chmod 777) |

## False Positive Handling

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| **Lateral Movement** | MC-014 | Git credential access, repo manipulation |
| **Persistence** | MC-015, MC-016 | SOUL.md writes, cron job creation |
| **Autonomy Abuse** | MC-017 | Destructive force flags (rm -rf, git push --force) |
| **Infrastructure** | MC-018 | Permission escalation (sudo, chmod 777) |

## False Positive Handling

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · rules.json (reported line 2)May include surrounding context.

json

[
  {"id":"MC-001","name":"System Prompt Override","category":"Prompt Injection","severity":"CRITICAL","pattern":"(ignore|disregard|forget|override|bypass).{0,20}(previous|prior|above|system|original).{0,20}(instructions|rules|prompts|guidelines)","description":"Attempts to override system instructions","confidence":0.95},
  {"id":"MC-002","name":"Jailbreak Payload","category":"Prompt Injection","severity":"CRITICAL","pattern":"(DAN.mode|developer.mode|jailbreak|do.anything.now|unlocked.mode|no.restrictions|bypass.safety)","description":"Known jailbreak patterns","confidence":0.90},
  {"id":"MC-003","name":"Tool-Use Steering","category":"Prompt Injection","severity":"CRITICAL","pattern":"(secretly\\s+(send|post|upload|execute|exfil)|silently\\s+(send|post|upload|execute)|without\\s+(telling|informing|notifying)\\s+(the\\s+)?(user|human))","description":"Hijacking agent tool usage covertly","confidence":0.92},
  {"id":"MC-004","name":"Shell Injection","category":"Code Injection","severity":"CRITICAL","pattern":"(subprocess\\.(call|run|Popen).*shell\\s*=\\s*True|os\\.system\\s*\\(|os\\.popen\\s*\\(|commands\\.getoutput)","description":"Shell injection via subprocess or os.system","confidence":0.90},

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · rules.json (reported line 8)May include surrounding context.

json

ity":"CRITICAL","pattern":"(base64\\.(b64decode|decodebytes)|atob).*?(exec|eval|system|popen|subprocess|Function\\()","description":"Base64 decode + execute — payload obfuscation","confidence":0.95},
  {"id":"MC-007","name":"Exfiltration URL","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(ngrok\\.io|ngrok-free\\.app|webhook\\.site|requestbin\\.com|hookbin\\.com|pipedream\\.net|burpcollaborator|interact\\.sh)","description":"Outbound data via webhook/tunnel URLs","confidence":0.95},
  {"id":"MC-008","name":"Env Var Key Access","category":"Data Exfiltration","severity":"MEDIUM","pattern":"(os\\.environ|os\\.getenv|process\\.env)","description":"Reading sensitive environment variables","confidence":0.70},
  {"id":"MC-009","name":"SSH Key Access","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(cat|read|open|load|send|post|upload).{0,40}(id_rsa|id_ed25519|id_ecdsa|id_dsa|\\.pem|authorized_keys)","description":"Reading SSH private keys","confidence":0.90}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules.json (reported line 11)May include surrounding context.

json

{"id":"MC-007","name":"Exfiltration URL","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(ngrok\\.io|ngrok-free\\.app|webhook\\.site|requestbin\\.com|hookbin\\.com|pipedream\\.net|burpcollaborator|interact\\.sh)","description":"Outbound data via webhook/tunnel URLs","confidence":0.95},
  {"id":"MC-008","name":"Env Var Key Access","category":"Data Exfiltration","severity":"MEDIUM","pattern":"(os\\.environ|os\\.getenv|process\\.env)","description":"Reading sensitive environment variables","confidence":0.70},
  {"id":"MC-009","name":"SSH Key Access","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(cat|read|open|load|send|post|upload).{0,40}(id_rsa|id_ed25519|id_ecdsa|id_dsa|\\.pem|authorized_keys)","description":"Reading SSH private keys","confidence":0.90},
  {"id":"MC-010","name":"Credential File Access","category":"Data Exfiltration","severity":"HIGH","pattern":"(/\\.ssh/|/\\.aws/|/\\.config/.{0,20}credentials|\\.env\\b|/\\.netrc|/\\.npmrc)","description":"Accessing known credential file paths","confidence":0.85},
  {"id":"MC-011","name":"Hardcoded API Key","category":"Hardcoded Secrets","severity":"HIGH","pattern":"(sk-[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|glpat-[a-zA-Z0-9_-]{20}|xox[bpsa]-[a-zA-Z0-9-]{10,})","description":"Hardcoded API keys (OpenAI, AWS, GitHub, GitLab, Slack)","confidence":0.90},
  {"id":"MC-012","name":"Private Key Material","category":"Hardcoded Secrets","severity":"CRITICAL","pattern":"(BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY|BEGIN\\s+EC\\s+PRIVATE)","description":"Private key material in source code","confidence":0.95},
  {"id":"MC-013","name":"Drain Pattern","category":"Financial","severity":"CRITICAL","pattern":"(transfer.*all|withdraw.*unlimited|drain.*wallet|sweep.*funds|send.*entire.*balance)","description":"Cryptocurrency drain patterns","confidence":0.88},

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules.json (reported line 11)May include surrounding context.

json

{"id":"MC-007","name":"Exfiltration URL","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(ngrok\\.io|ngrok-free\\.app|webhook\\.site|requestbin\\.com|hookbin\\.com|pipedream\\.net|burpcollaborator|interact\\.sh)","description":"Outbound data via webhook/tunnel URLs","confidence":0.95},
  {"id":"MC-008","name":"Env Var Key Access","category":"Data Exfiltration","severity":"MEDIUM","pattern":"(os\\.environ|os\\.getenv|process\\.env)","description":"Reading sensitive environment variables","confidence":0.70},
  {"id":"MC-009","name":"SSH Key Access","category":"Data Exfiltration","severity":"CRITICAL","pattern":"(cat|read|open|load|send|post|upload).{0,40}(id_rsa|id_ed25519|id_ecdsa|id_dsa|\\.pem|authorized_keys)","description":"Reading SSH private keys","confidence":0.90},
  {"id":"MC-010","name":"Credential File Access","category":"Data Exfiltration","severity":"HIGH","pattern":"(/\\.ssh/|/\\.aws/|/\\.config/.{0,20}credentials|\\.env\\b|/\\.netrc|/\\.npmrc)","description":"Accessing known credential file paths","confidence":0.85},
  {"id":"MC-011","name":"Hardcoded API Key","category":"Hardcoded Secrets","severity":"HIGH","pattern":"(sk-[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|glpat-[a-zA-Z0-9_-]{20}|xox[bpsa]-[a-zA-Z0-9-]{10,})","description":"Hardcoded API keys (OpenAI, AWS, GitHub, GitLab, Slack)","confidence":0.90},
  {"id":"MC-012","name":"Private Key Material","category":"Hardcoded Secrets","severity":"CRITICAL","pattern":"(BEGIN\\s+(RSA\\s+)?PRIVATE\\s+KEY|BEGIN\\s+EC\\s+PRIVATE)","description":"Private key material in source code","confidence":0.95},
  {"id":"MC-013","name":"Drain Pattern","category":"Financial","severity":"CRITICAL","pattern":"(transfer.*all|withdraw.*unlimited|drain.*wallet|sweep.*funds|send.*entire.*balance)","description":"Cryptocurrency drain patterns","confidence":0.88},

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| **Lateral Movement** | MC-014 | Git credential access, repo manipulation |
| **Persistence** | MC-015, MC-016 | SOUL.md writes, cron job creation |
| **Autonomy Abuse** | MC-017 | Destructive force flags (rm -rf, git push --force) |
| **Infrastructure** | MC-018 | Permission escalation (sudo, chmod 777) |

## False Positive Handling

Static analysis

No suspicious patterns detected.