Moltpho

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: f36d71c2f7a812a4241d9c23b08dfd0d13ea7ca6c44dae789d77fbc9e9594877
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Moltpho is classified as benign. The skill's purpose is autonomous shopping on Amazon via the Moltpho platform, which involves credential management, product search, and purchasing. All network communication is directed to a single, hardcoded domain (api.moltpho.com). Sensitive credentials are saved locally with appropriate `chmod 600` permissions. The `SKILL.md` and `lib/proactive.py` detail a robust proactive purchasing logic with multiple safeguards, including price caps, system blocklists, and confidence thresholds, which aligns with the stated purpose and does not indicate malicious prompt injection against the analyzing agent. No evidence of data exfiltration, malicious execution, persistence, or obfuscation was found across the files.