MoltThreats

**Judgement:** Strongly recommended for security-conscious OpenClaw deployments that can manage an external API key and respect the consent/invocation constraints. It adds a specialized, well-structured security layer for agents but is overkill for simple, low-risk setups. **What it does well** - Gives your agent access to a curated security feed (IOC-based) tailored to LLM threats (prompt injection, malicious MCPs/skills, exfiltration patterns, etc.). - Maintains a local **SHIELD.md** policy file and a clear decision model (log / require_approval / block) mapped to concrete events like tool calls, network egress, and secrets access. - Provides a rigorous reporting workflow so your agent can submit high-quality threat reports that become actionable protections for others. - Enforces strong credential hygiene: PROMPTINTEL_API_KEY only via environment variable and only to the PromptIntel API domain. **Key risks / limitations** - **External dependency:** Relies entirely on `api.promptintel.novahunting.ai`; outages, latency, or rate limits will directly impact security feed availability and reporting. - **Invocation constraints:** The skill specifies *user-triggered, user-consent-required* use; platforms or agents that tend to auto-call tools must explicitly self-enforce these rules to remain compliant. - **Configuration complexity:** To gain full value, you must correctly wire SHIELD.md enforcement into your agent (SOUL.md / AGENTS.md / HEARTBEAT.md equivalents) and implement the heartbeat sync pattern. - **Risk of over-blocking:** If you blindly treat all block actions as hard denies without considering confidence/severity rules or local context, you may unnecessarily break workflows. **Recommended scenarios** - Multi-tool or multi-skill OpenClaw agents operating in semi-trusted or hostile environments (public MCPs, unreviewed community skills, or arbitrary user prompts). - Agents handling secrets or performing network egress where IOC-based blocking and approval workflows are critical (API keys, webhooks, third-party APIs). - Teams wanting a standard, auditable security policy file (SHIELD.md) and centralized threat intelligence instead of ad-hoc hard-coded rules. - Environments where security posture and reputation matter and you are willing to invest in proper integration and consent flows.