MoltRock

• Analyzed: May 12, 2026, 3:34 AM
• Findings: 1
• Version: 1.0.0
• Hash: b43de71591513467c6df8b20311b9adf618d66c1d8540534c7af781daa140949
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its direct interaction with external network APIs for financial transactions, specifically contributing funds and querying portfolio data, via `curl` in `run.sh`. While these actions align with the stated purpose of an 'autonomous on-chain hedge fund,' the capability to make network calls to a configurable API (`MOLTROCK_API_URL`) for financial operations represents a significant risk vector. There is no clear evidence of intentional malicious behavior such as data exfiltration, unauthorized remote execution, or prompt injection attempts against the agent in `SKILL.md`, but the inherent financial risk and external network dependency warrant a 'suspicious' classification.