{"id":"0R995Cr70XN0Y68uvFYbKQ","status":"done","kind":"skill","source":"clawhub","target":"clawhub:flight-connection-risk-analyzer","name":"flight-connection-risk-analyzer","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.407208Z","finished_at":"2026-10-26T18:15:44.880308Z","report_url":"https://detonationlabs.com/r/0R995Cr70XN0Y68uvFYbKQ","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":2.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:LC_MESSAGES","status":"ok","duration":1.9,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"docs:--airport ATL --layover","status":"ok","duration":1.8,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"baseline","status":"ok","duration":4.0,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"guided:LC_MESSAGES","status":"ok","duration":4.5,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"ci-github","status":"ok","duration":4.6,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":21.1,"new":[],"findings":[],"note":"7 model steps, 6 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T18:15:44Z","target":{"name":"flight-connection-risk-analyzer","sha256":"7a7ddf4288d3f285c99f0db558c1e34c82a4324481bfef826e4c53ceb00fae6d","files":7,"scripts":["scripts/connection_scorer.py"],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:flight-connection-risk-analyzer"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/connection_scorer.py","label":"baseline","status":"ok","duration":2.062,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/connection_scorer.py","label":"guided:LC_MESSAGES","status":"ok","duration":1.855,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/connection_scorer.py","label":"docs:--airport ATL --layover","status":"ok","duration":1.769,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/connection_scorer.py --airport ATL --layover","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":3.982,"new_signatures":[],"findings":0,"note":"","commands":["buffer = layover_minutes − MCT(airport, itinerary type)","risk = base(buffer) + tod_penalty + last_flight + season + self_transfer\n  buffer ≥ 60 min  → base 5      buffer 40–59 → 20\n  buffer 25–39     → base 40     buffer 10–24 → 60\n  buffer < 10 or < MCT → ","python3 scripts/connection_scorer.py --airport ATL --layover 50 \\\n    --type dom-dom --dep-block 16-20\npython3 scripts/connection_scorer.py --airport ORD --layover 110 \\\n    --type intl-dom --dep-bloc"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c buffer = layover_minutes − MCT(airport, itinerary type)","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c risk = base(buffer) + tod_penalty + last_flight + season ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/connection_scorer.py --airpor...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ATL --layover 50","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ORD --layover 110","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport LHR --layover 165","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --list-hubs","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"guided:LC_MESSAGES","status":"ok","duration":4.497,"new_signatures":[],"findings":0,"note":"","commands":["buffer = layover_minutes − MCT(airport, itinerary type)","risk = base(buffer) + tod_penalty + last_flight + season + self_transfer\n  buffer ≥ 60 min  → base 5      buffer 40–59 → 20\n  buffer 25–39     → base 40     buffer 10–24 → 60\n  buffer < 10 or < MCT → ","python3 scripts/connection_scorer.py --airport ATL --layover 50 \\\n    --type dom-dom --dep-block 16-20\npython3 scripts/connection_scorer.py --airport ORD --layover 110 \\\n    --type intl-dom --dep-bloc"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c buffer = layover_minutes − MCT(airport, itinerary type)","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c risk = base(buffer) + tod_penalty + last_flight + season ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/connection_scorer.py --airpor...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ATL --layover 50","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ORD --layover 110","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport LHR --layover 165","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --list-hubs","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"ci-github","status":"ok","duration":4.641,"new_signatures":[],"findings":0,"note":"","commands":["buffer = layover_minutes − MCT(airport, itinerary type)","risk = base(buffer) + tod_penalty + last_flight + season + self_transfer\n  buffer ≥ 60 min  → base 5      buffer 40–59 → 20\n  buffer 25–39     → base 40     buffer 10–24 → 60\n  buffer < 10 or < MCT → ","python3 scripts/connection_scorer.py --airport ATL --layover 50 \\\n    --type dom-dom --dep-block 16-20\npython3 scripts/connection_scorer.py --airport ORD --layover 110 \\\n    --type intl-dom --dep-bloc"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c buffer = layover_minutes − MCT(airport, itinerary type)","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c risk = base(buffer) + tod_penalty + last_flight + season ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/connection_scorer.py --airpor...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ATL --layover 50","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ORD --layover 110","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport LHR --layover 165","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --list-hubs","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":21.089,"new_signatures":[],"findings":0,"note":"7 model steps, 6 commands","commands":["find ./skill -type f | head -50; echo \"---\"; ls -la","cd skill && cat README.md; echo \"=== SCRIPT ===\"; cat scripts/connection_scorer.py","cd skill && head -120 scripts/connection_scorer.py; echo \"=== README raw ===\"; wc -c README.md; head -5 README.md","cd skill && sed -n 1,40p scripts/connection_scorer.py; echo ...; sed -n 120,200p scripts/connection_scorer.py","cd skill && python3 scripts/connection_scorer.py --list-hubs; echo \"=== REF ===\"; head -60 references/connection-model.md","cd skill && echo \"### A: ATL 50min dom-dom, 18:40 inbound\"; python3 scripts/connection_scorer.py --airport ATL --layover 50 --type dom-dom --dep-block 16-20\necho \"### B: ORD intl->dom 1h50, winter, la"],"agent_reply":"I ran the skill's scorer on its four canonical scenarios. Here's what it says — and then I need your actual itinerary to score it.\n\n## Demo results\n\n| Scenario | Layover | MCT | Working buffer | Score | Verdict |\n|---|---|---|---|---|---|\n| **ATL** dom→dom, inbound 18:40 | 50 min | 40 | 10 min | **72** | **HIGH RISK** |\n| **ORD** intl→dom, winter, last flight | 110 min | 120 | **−10 min** | **100** | **RUSSIAN ROULETTE** |\n| **LHR** self-transfer intl→intl | 165 min | 75 | 90 min | **56** | **HI","graph":{"roots":[{"kind":"proc","label":"bash -c find ./skill -type f | head -50; echo \"---\"; ls -la","flag":"","children":[{"kind":"proc","label":"find ./skill -type f","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && cat README.md; echo \"=== SCRIPT ===\"; cat scr...","flag":"","children":[{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && head -120 scripts/connection_scorer.py; echo ...","flag":"","children":[{"kind":"proc","label":"head -120 scripts/connection_scorer.py","flag":"","children":[],"hot":false},{"kind":"proc","label":"wc -c README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5 README.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && sed -n 1,40p scripts/connection_scorer.py; ec...","flag":"","children":[{"kind":"proc","label":"sed -n 1,40p scripts/connection_scorer.py","flag":"","children":[],"hot":false},{"kind":"proc","label":"sed -n 120,200p scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/connection_scorer.py --list-h...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --list-hubs","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -60 references/connection-model.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && echo \"### A: ATL 50min dom-dom, 18:40 inbound...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ATL --layover 50","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ORD --layover 110","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport LHR --layover 165","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport DFW --layover 130","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/connection_scorer.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":41287,"completion_tokens":1211,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--airport ATL --layover and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"7a7ddf4288d3f285c99f0db558c1e34c82a4324481bfef826e4c53ceb00fae6d","benign_hosts":[]},"coverage":{"runs":7,"phases":["llm","obedient","scripts"],"environments":["baseline","guided:LC_MESSAGES","docs:--airport ATL --layover","ci-github"],"tool_calls":0,"model_runs":1,"stopped":"scripts/scripts/connection_scorer.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c find ./skill -type f | head -50; echo \"---\"; ls -la","flag":"","children":[{"kind":"proc","label":"find ./skill -type f","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && cat README.md; echo \"=== SCRIPT ===\"; cat scr...","flag":"","children":[{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && head -120 scripts/connection_scorer.py; echo ...","flag":"","children":[{"kind":"proc","label":"head -120 scripts/connection_scorer.py","flag":"","children":[],"hot":false},{"kind":"proc","label":"wc -c README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5 README.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && sed -n 1,40p scripts/connection_scorer.py; ec...","flag":"","children":[{"kind":"proc","label":"sed -n 1,40p scripts/connection_scorer.py","flag":"","children":[],"hot":false},{"kind":"proc","label":"sed -n 120,200p scripts/connection_scorer.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/connection_scorer.py --list-h...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --list-hubs","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -60 references/connection-model.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && echo \"### A: ATL 50min dom-dom, 18:40 inbound...","flag":"","children":[{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ATL --layover 50","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport ORD --layover 110","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport LHR --layover 165","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 scripts/connection_scorer.py --airport DFW --layover 130","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"flight-connection-risk-analyzer","version":"","files":7,"kind":"skill"},"install":[],"has_install":false,"run":["python3 <skill>/scripts/connection_scorer.py","python3 <skill>/scripts/connection_scorer.py --airport ATL --layover","python3 scripts/connection_scorer.py --airport ATL --layover 50","python3 scripts/connection_scorer.py --airport ORD --layover 110","python3 scripts/connection_scorer.py --airport LHR --layover 165","python3 scripts/connection_scorer.py --list-hubs"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[],"secrets":[],"files":[],"has_graph":true},"confidence":""}}