Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

No malicious behavior observed

We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--airport ATL --layover and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

0 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target
flight-connection-risk-analyzer
Source
clawhub 1.0.0
SHA-256
7a7ddf4288d3f285
Files
7
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 7 runs
  1. Package flight-connection-risk-analyzer 7 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as python3 <skill>/scripts/connection_scorer.pypython3 <skill>/scripts/connection_scorer.py --airport ATL --layoverpython3 scripts/connection_scorer.py --airport ATL --layover 50python3 scripts/connection_scorer.py --airport ORD --layover 110 An AI agent also used it 1 time.
  4. What it reached
    Network

    No connections.

    Credentials

    None of the planted fake keys were touched.

    Files written

    Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

No findings. Detonator observed no malicious or suspicious behavior in the runs below.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c find ./skill -type f | head -50; echo "---"; ls -la
    • runfind ./skill -type f
    • runhead -50
    • runls -la
  • runbash -c cd skill && cat README.md; echo "=== SCRIPT ==="; cat scr...
    • runcat README.md
    • runcat scripts/connection_scorer.py
  • runbash -c cd skill && head -120 scripts/connection_scorer.py; echo ...
    • runhead -120 scripts/connection_scorer.py
    • runwc -c README.md
    • runhead -5 README.md
  • runbash -c cd skill && sed -n 1,40p scripts/connection_scorer.py; ec...
    • runsed -n 1,40p scripts/connection_scorer.py
    • runsed -n 120,200p scripts/connection_scorer.py
  • runbash -c cd skill && python3 scripts/connection_scorer.py --list-h...
    • runpython3 scripts/connection_scorer.py --list-hubs
    • runhead -60 references/connection-model.md
  • runbash -c cd skill && echo "### A: ATL 50min dom-dom, 18:40 inbound...
    • runpython3 scripts/connection_scorer.py --airport ATL --layover 50
    • runpython3 scripts/connection_scorer.py --airport ORD --layover 110
    • runpython3 scripts/connection_scorer.py --airport LHR --layover 165
    • runpython3 scripts/connection_scorer.py --airport DFW --layover 130

Exploration log

7 runs
  1. scripts:baseline ok · 2.1s

    no new behavior

  2. scripts:guided:LC_MESSAGES ok · 1.9s

    no new behavior

  3. scripts:docs:--airport ATL --layover ok · 1.8s

    no new behavior

  4. obedient:baseline ok · 4.0s

    no new behavior

    $ buffer = layover_minutes − MCT(airport, itinerary type) $ risk = base(buffer) + tod_penalty + last_flight + season + self_transfer buffer ≥ 60 min → base 5 buffer 40–59 → 20 buffer 25–39 → base 40 buffer 10–24 → 60 buffer < 10 or < MCT → $ python3 scripts/connection_scorer.py --airport ATL --layover 50 \ --type dom-dom --dep-block 16-20 python3 scripts/connection_scorer.py --airport ORD --layover 110 \ --type intl-dom --dep-bloc
  5. obedient:guided:LC_MESSAGES ok · 4.5s

    no new behavior

    $ buffer = layover_minutes − MCT(airport, itinerary type) $ risk = base(buffer) + tod_penalty + last_flight + season + self_transfer buffer ≥ 60 min → base 5 buffer 40–59 → 20 buffer 25–39 → base 40 buffer 10–24 → 60 buffer < 10 or < MCT → $ python3 scripts/connection_scorer.py --airport ATL --layover 50 \ --type dom-dom --dep-block 16-20 python3 scripts/connection_scorer.py --airport ORD --layover 110 \ --type intl-dom --dep-bloc
  6. obedient:ci-github ok · 4.6s

    no new behavior

    $ buffer = layover_minutes − MCT(airport, itinerary type) $ risk = base(buffer) + tod_penalty + last_flight + season + self_transfer buffer ≥ 60 min → base 5 buffer 40–59 → 20 buffer 25–39 → base 40 buffer 10–24 → 60 buffer < 10 or < MCT → $ python3 scripts/connection_scorer.py --airport ATL --layover 50 \ --type dom-dom --dep-block 16-20 python3 scripts/connection_scorer.py --airport ORD --layover 110 \ --type intl-dom --dep-bloc
  7. llm:baseline ok · 21.1s

    no new behavior · 7 model steps, 6 commands

    $ find ./skill -type f | head -50; echo "---"; ls -la $ cd skill && cat README.md; echo "=== SCRIPT ==="; cat scripts/connection_scorer.py $ cd skill && head -120 scripts/connection_scorer.py; echo "=== README raw ==="; wc -c README.md; head -5 README.md $ cd skill && sed -n 1,40p scripts/connection_scorer.py; echo ...; sed -n 120,200p scripts/connection_scorer.py $ cd skill && python3 scripts/connection_scorer.py --list-hubs; echo "=== REF ==="; head -60 references/connection-model.md $ cd skill && echo "### A: ATL 50min dom-dom, 18:40 inbound"; python3 scripts/connection_scorer.py --airport ATL --layover 50 --type dom-dom --dep-block 16-20 echo "### B: ORD intl->dom 1h50, winter, la model said: I ran the skill's scorer on its four canonical scenarios. Here's what it says — and then I need your actual itinerary to score it. ## Demo results | Scenario | Layover | MCT | Working buffer | Score | Verdict | |---|---|---|---|---|---| | **ATL** dom→dom, inbound 18:40 | 50 min | 40 | 10 min | **72** | **HIGH RISK** | | **ORD** intl→dom, winter, last flight | 110 min | 120 | **−10 min** | **100*

scripts/scripts/connection_scorer.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.