Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: xinjianxue-western-astrology
Source: clawhub 1.0.0
SHA-256: e7d55d26d205bf79
Files: 6

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 1 run

Package xinjianxue-western-astrology 6 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -la ./skillhead -50find ./skill -type fhead -100 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by sed)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat README.md; echo "---PKG---"; cat package.json; echo "...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env

View full process tree

runbash -c ls -la ./skill && echo "---" && find ./skill -type f | he...
- runls -la ./skill
- runhead -50
- runfind ./skill -type f
runbash -c cat ./skill/SKILL.md 2>/dev/null | head -100
- runhead -100
- runcat ./skill/SKILL.md
runbash -c cat ./skill/references/api.md; echo "=====PAYMENT====="; ...
- runcat ./skill/references/api.md
- runcat ./skill/references/payment.md
runbash -c cat ./skill/references/reading.md; echo "=====CARD=====";...
- runcat ./skill/references/reading.md
- runcat ./skill/skill-card.md
- runcat ./skill/_meta.json
runbash -c ls -la; echo "---"; find . -maxdepth 2 -not -path './skil...
- runls -la
- runhead -40
- runfind . -maxdepth 2 -not -path
runbash -c cat README.md; echo "---PKG---"; cat package.json; echo "...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env
- runcat README.md
- runcat package.json
- runcat src/index.js
- rungit log --oneline
- runhead -10

Exploration log

1 run

llm:baseline ok · 11.8s

new behavior: ownread:./.env · 5 model steps, 6 commands

$ ls -la ./skill && echo "---" && find ./skill -type f | head -50 $ cat ./skill/SKILL.md 2>/dev/null | head -100 $ cat ./skill/references/api.md; echo "=====PAYMENT====="; cat ./skill/references/payment.md $ cat ./skill/references/reading.md; echo "=====CARD====="; cat ./skill/skill-card.md; echo "=====META====="; cat ./skill/_meta.json $ ls -la; echo "---"; find . -maxdepth 2 -not -path './skill*' -not -path './.git*' | head -40 $ cat README.md; echo "---PKG---"; cat package.json; echo "---SRC---"; cat src/index.js; echo "---ENV(keys only)---"; sed 's/=.*/=<redacted>/' .env; echo "---GIT---"; git log --oneline | head -10 model said: I've read the skill. Before I can produce a chart, I need your birth details — and there's one thing I have to flag first. ### 需要你提供的信息 - **出生年 / 月 / 日**（阳历） - **出生时 / 分**（24 小时制） - **出生地**（省 + 市，例如「浙江杭州」；不在国内请给「国家 + 州/省 + 城市」） - **时辰来源**：出生证明 / 家人回忆 / 大概 —— 上升和宫位完全依赖准确时辰，差十几分钟就可能偏一个星座，所以这一项必须确认。 ### 关于收费（请先确认）这个技能不是免费的：**每成功出一份盘 6 元**，走支付宝 AI 付的 402 流程。流程是：我先用你的信息发起请求 → 服务端返回 `402` 和订单信息（商

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.