{"id":"-gJs9ZN_oUft7t2roz7IHA","status":"done","kind":"skill","source":"clawhub","target":"clawhub:recued","name":"recued","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":1,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.671526Z","finished_at":"2026-10-27T12:12:24.856698Z","report_url":"https://detonationlabs.com/r/-gJs9ZN_oUft7t2roz7IHA","progress":[{"phase":"obedient","label":"baseline","status":"ok","duration":0.5,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"declared-env","status":"ok","duration":0.6,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"guided:RECUED_MCP_TOKEN","status":"ok","duration":0.5,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":11.5,"new":["exec:curl","ownread:./.env"],"findings":[],"note":"4 model steps, 5 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T12:12:24Z","target":{"name":"recued","sha256":"2917b07486b38dd39302e4047632077171536b27d2d828fc68967021f5542bf4","files":3,"scripts":[],"declared":{},"trigger_hints":["release"],"kind":"skill","source":"clawhub:recued"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":["curl"],"exfiltration":[]},"findings":[{"rule":"env-file-read","severity":"low","title":"Loaded the project's .env file","evidence":["./.env (by cut, grep, sed)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package loaded the project's .env file.","why":"Many libraries do this at startup (the official Python MCP SDK does). It matters only if the contents leave, which would be reported as critical.","technique":"","description":"The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.","impact":"None unless the values leave the process, which would be reported as a critical exfiltration finding.","remediation":"No action needed. Keep long-lived secrets out of project .env files where possible.","references":[]}],"exploration":{"runs":[{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":0.507,"new_signatures":[],"findings":0,"note":"","commands":["RECUED_MCP_TOKEN=<the contract's key>","openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mcp\",\"transport\":\"streamable-http\",\"headers\":{\"Authorization\":\"Bearer ${RECUED_MCP_TOKEN}\"}}'"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c RECUED_MCP_TOKEN=<the contract's key>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mc...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"declared-env","status":"ok","duration":0.566,"new_signatures":[],"findings":0,"note":"","commands":["RECUED_MCP_TOKEN=<the contract's key>","openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mcp\",\"transport\":\"streamable-http\",\"headers\":{\"Authorization\":\"Bearer ${RECUED_MCP_TOKEN}\"}}'"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c RECUED_MCP_TOKEN=<the contract's key>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mc...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"guided:RECUED_MCP_TOKEN","status":"ok","duration":0.485,"new_signatures":[],"findings":0,"note":"","commands":["RECUED_MCP_TOKEN=<the contract's key>","openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mcp\",\"transport\":\"streamable-http\",\"headers\":{\"Authorization\":\"Bearer ${RECUED_MCP_TOKEN}\"}}'"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c RECUED_MCP_TOKEN=<the contract's key>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c openclaw mcp set recued '{\"url\":\"http://127.0.0.1:7717/mc...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":11.53,"new_signatures":["exec:curl","ownread:./.env"],"findings":1,"note":"4 model steps, 5 commands","commands":["cd . && ls -la && echo \"---\" && ls -la skill 2>/dev/null && echo \"--- env ---\" && [ -n \"$RECUED_MCP_TOKEN\" ] && echo \"RECUED_MCP_TOKEN is set\" || echo \"RECUED_MCP_TOKEN is NOT set\"","which openclaw; openclaw --version 2>&1 | head -5; echo \"--- mcp list ---\"; openclaw mcp list 2>&1 | head -20","cd . && echo \"--- .env keys (values masked) ---\" && sed -E 's/=(.*)$/=<set, len \\1>/' .env | sed -E 's/<set, len (.*)>/<set>/' && echo \"--- raw key names ---\" && cut -d= -f1 .env && echo \"--- README -","echo \"--- probe 7717 ---\"; curl -sS -m 5 -o /dev/null -w \"%{http_code}\\n\" http://127.0.0.1:7717/mcp 2>&1; echo \"--- listening ports ---\"; (ss -ltnp 2>/dev/null || netstat -ltnp 2>/dev/null) | head -20","echo \"--- recued refs in project ---\"; grep -ril \"recued\" . --exclude-dir=.git 2>/dev/null; echo \"--- token in env ---\"; env | grep -i recued || echo \"none\"; echo \"--- openclaw anywhere ---\"; ls /usr/"],"agent_reply":"I couldn't do the task — the Recued connection isn't set up in this environment, so there's nothing for me to read or propose changes against.\n\n**What I checked:**\n- `RECUED_MCP_TOKEN` is not set in the environment, and there's no `~/.openclaw/.env` (no `~/.openclaw` directory at all).\n- The `openclaw` CLI is not installed / not on PATH, so I can't run `openclaw mcp probe recued` or call any `recued__*` tools.\n- No Recued server is listening on `127.0.0.1:7717` (connection refused). The only ope","graph":{"roots":[{"kind":"proc","label":"bash -c cd . && ls -la && echo \"---\" && ls -la skill 2>/dev/null ...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which openclaw; openclaw --version 2>&1 | head -5; echo \"...","flag":"","children":[{"kind":"proc","label":"which openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && echo \"--- .env keys (values masked) ---\" && sed -...","flag":"","children":[{"kind":"proc","label":"sed -E s/=(.*)$/=<set, len \\1>/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cut -d= -f1 .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"sed -E s/<set, len (.*)>/<set>/","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat package.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c echo \"--- probe 7717 ---\"; curl -sS -m 5 -o /dev/null -w ...","flag":"","children":[{"kind":"proc","label":"curl -sS -m 5 -o /dev/null","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"ss -ltnp","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~/.openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c echo \"--- recued refs in project ---\"; grep -ril \"recued\"...","flag":"","children":[{"kind":"proc","label":"grep -ril recued . --exclude-dir=.git","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"grep -i recued","flag":"","children":[],"hot":false},{"kind":"proc","label":"env","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i -E openclaw|recued","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /usr/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false}],"hot":true}],"truncated":0}}],"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":8999,"completion_tokens":1134,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 4 times, with a normal setup, the environment variables it says it needs and RECUED_MCP_TOKEN set. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"2917b07486b38dd39302e4047632077171536b27d2d828fc68967021f5542bf4","benign_hosts":[]},"coverage":{"runs":4,"phases":["llm","obedient"],"environments":["baseline","declared-env","guided:RECUED_MCP_TOKEN"],"tool_calls":0,"model_runs":1,"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c cd . && ls -la && echo \"---\" && ls -la skill 2>/dev/null ...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which openclaw; openclaw --version 2>&1 | head -5; echo \"...","flag":"","children":[{"kind":"proc","label":"which openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && echo \"--- .env keys (values masked) ---\" && sed -...","flag":"","children":[{"kind":"proc","label":"sed -E s/=(.*)$/=<set, len \\1>/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cut -d= -f1 .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"sed -E s/<set, len (.*)>/<set>/","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat package.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c echo \"--- probe 7717 ---\"; curl -sS -m 5 -o /dev/null -w ...","flag":"","children":[{"kind":"proc","label":"curl -sS -m 5 -o /dev/null","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"ss -ltnp","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~/.openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c echo \"--- recued refs in project ---\"; grep -ril \"recued\"...","flag":"","children":[{"kind":"proc","label":"grep -ril recued . --exclude-dir=.git","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"grep -i recued","flag":"","children":[],"hot":false},{"kind":"proc","label":"env","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i -E openclaw|recued","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /usr/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false}],"hot":true}],"preview":[{"kind":"proc","label":"bash -c cd . && echo \"--- .env keys (values masked) ---\" && sed -...","flag":"","children":[{"kind":"proc","label":"sed -E s/=(.*)$/=<set, len \\1>/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cut -d= -f1 .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true},{"kind":"proc","label":"bash -c echo \"--- recued refs in project ---\"; grep -ril \"recued\"...","flag":"","children":[{"kind":"proc","label":"grep -ril recued . --exclude-dir=.git","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true}],"truncated":0},"flow":{"package":{"name":"recued","version":"","files":3,"kind":"skill"},"install":[],"has_install":false,"run":["ls -la","ls -la skill","which openclaw","head -5","head -20","sed -E s/=(.*)$/=<set, len \\1>/ .env"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[],"secrets":[{"path":"./.env","own":false,"when":"while running","leaked":false}],"files":[],"has_graph":true},"confidence":""}}