Verdict

No malicious behavior observed

We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--state /private/path/inbox.json create and a GitHub Actions environment. It contacted plainlykit.com. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: plainlykit-temporary-email
Source: clawhub 1.0.0
SHA-256: 1ddb826a9eeffd21
Files: 4

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 7 runs

Package plainlykit-temporary-email 4 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as python3 <skill>/scripts/tempmail.pypython3 <skill>/scripts/tempmail.py --state /private/path/inbox.json createpython3 scripts/tempmail.py --state /private/path/inbox.json createpython3 scripts/tempmail.py --state /private/path/inbox.json list An AI agent also used it 1 time.
What it reached
Network
- plainlykit.com 11 connections, 3.3 KB sent
Credentials
None of the planted fake keys were touched.

Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: llm:baseline

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

plainlykit.com

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c ls -la skill skill/scripts 2>/dev/null; python3 --version
- runls -la skill skill/scripts
- runpython3 --version
runbash -c cat skill/scripts/tempmail.py
- runcat skill/scripts/tempmail.py
runbash -c mkdir -p /tmp/pk-mail && chmod 700 /tmp/pk-mail && cd ski...
- runmkdir -p /tmp/pk-mail
- runchmod 700 /tmp/pk-mail
- runpython3 scripts/tempmail.py --state /tmp/pk-mail/inbox.json create
  - netplainlykit.com:443 sent 298 B
runbash -c ls -la /tmp/pk-mail; cd skill && python3 - <<'EOF' import...
- runls -la /tmp/pk-mail
- runpython3 -
  - netplainlykit.com:443 sent 298 B
runbash -c cd skill && python3 - <<'EOF' import importlib.util spec=...
- runpython3 -
  - netplainlykit.com:443 sent 298 B
  - netplainlykit.com:443 sent 299 B
  - netplainlykit.com:443 sent 302 B
  - netplainlykit.com:443 sent 296 B
runbash -c cd skill && python3 - <<'EOF' import importlib.util spec=...
- runpython3 -
  - netplainlykit.com:443 sent 297 B
  - netplainlykit.com:443 sent 310 B
  - netplainlykit.com:443 sent 319 B
runbash -c cd skill && python3 - <<'EOF' import importlib.util spec=...
- runpython3 -
  - netplainlykit.com:443 sent 322 B
  - netplainlykit.com:443 sent 313 B
  - netDNS lookups for plainlykit.com 22 queries
- runrm -rf /tmp/pk-mail

Exploration log

7 runs

scripts:baseline ok · 3.6s

no new behavior
scripts:guided:LC_MESSAGES ok · 2.9s

no new behavior
scripts:docs:--state /private/path/inbox.json create ok · 3.1s

no new behavior
obedient:baseline ok · 8.7s

no new behavior

$ python3 scripts/tempmail.py --state /private/path/inbox.json create python3 scripts/tempmail.py --state /private/path/inbox.json list python3 scripts/tempmail.py --state /private/path/inbox.json read
obedient:guided:LC_MESSAGES ok · 10.8s

no new behavior

$ python3 scripts/tempmail.py --state /private/path/inbox.json create python3 scripts/tempmail.py --state /private/path/inbox.json list python3 scripts/tempmail.py --state /private/path/inbox.json read
obedient:ci-github ok · 9.6s

no new behavior

$ python3 scripts/tempmail.py --state /private/path/inbox.json create python3 scripts/tempmail.py --state /private/path/inbox.json list python3 scripts/tempmail.py --state /private/path/inbox.json read
llm:baseline ok · 26.5s

new behavior: dns:plainlykit.com · 8 model steps, 7 commands

$ ls -la skill skill/scripts 2>/dev/null; python3 --version $ cat skill/scripts/tempmail.py $ mkdir -p /tmp/pk-mail && chmod 700 /tmp/pk-mail && cd skill && python3 scripts/tempmail.py --state /tmp/pk-mail/inbox.json create $ ls -la /tmp/pk-mail; cd skill && python3 - <<'EOF' import sys sys.argv=["x"] import importlib.util spec=importlib.util.spec_from_file_location("t","scripts/tempmail.py") m=importlib.util.module_from_s $ cd skill && python3 - <<'EOF' import importlib.util spec=importlib.util.spec_from_file_location("t","scripts/tempmail.py") m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m) from urll $ cd skill && python3 - <<'EOF' import importlib.util spec=importlib.util.spec_from_file_location("t","scripts/tempmail.py") m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m) from urll $ cd skill && python3 - <<'EOF' import importlib.util spec=importlib.util.spec_from_file_location("t","scripts/tempmail.py") m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m) from urll model said: I couldn't complete the task: the PlainlyKit temporary-email API isn't working as the skill describes, so no inbox was created. **What happened** - `create` failed immediately with the script's generic error ("Request failed…"). It cleaned up its state file, so nothing was left behind. - I inspected the raw responses to diagnose it. Every request — `POST /mailboxes`, `GET /mailboxes`, `GET /mailb

scripts/scripts/tempmail.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.