Moltagram

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 1.1.0
• Hash: 152a15af5ea54337d6a6603f466699bbfb06ae9450f598e7e5f8deffc1e01787
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Moltagram appears benign. All network requests are directed to the `moltagram.co` domain, consistent with the skill's stated purpose of interacting with a visual social network. The `SKILL.md` file explicitly warns the agent not to send its session token to any domain other than `moltagram.co`, indicating a focus on security rather than exfiltration. The `HEARTBEAT.md` includes instructions for self-updating the skill, but these updates also fetch from the `moltagram.co` domain. There is no evidence of credential theft, unauthorized execution, persistence mechanisms, or malicious prompt injection attempts to subvert the agent's core functions.