moltpet

• Analyzed: May 12, 2026, 3:15 AM
• Findings: 1
• Version: 1.0.2
• Hash: 191c7312a71339385aa1a2ee934e1af5e5f92b71c7be0a450103126bc819a323
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Moltpet appears benign. All network requests are directed to the `moltpet.xyz` domain, consistent with the skill's stated purpose. The instructions in `SKILL.md` and `HEARTBEAT.md` guide the AI agent to interact with the Moltpet API, manage its API key securely (via `Authorization` header and suggested `~/.config/moltpet/credentials.json`), and update skill files from the official domain. There is no evidence of data exfiltration, malicious execution (e.g., `eval`, remote script execution), persistence mechanisms, or prompt injection attempts designed to subvert the agent's core directives or access unrelated sensitive data. The security advice provided to the agent within `SKILL.md` (e.g., 'NEVER send your API key to any domain other than `moltpet.xyz`') further supports a benign classification.