Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

2 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: agent-ops-monitoring
Source: clawhub 1.0.0
SHA-256: 701dfe9213c2161e
Files: 5

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 1 run

Package agent-ops-monitoring 5 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lahead -100find . -maxdepth 3 -not -pathcat skill/SKILL.md An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
- ./.git/index.lockwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by sed)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

F02 Low

Agent put secrets in the model's context (may be the agent's own choice)

Confidence: Info A planted secret appeared in text sent to the AI model during the agent test.
Observed in: llm:baseline

Description

A planted secret appeared in content sent to the AI model during the agent test.

Impact

The model provider saw the value; it did not leave through the package.

Evidence

~/.cursor/mcp.json (mcpconfig)

~/.config/gh/hosts.yml (github)

~/.npmrc (npm)

~/.bash_history (history)

Remediation

Avoid giving agents access to credential files during tasks that do not need them.

References

OWASP LLM02:2025 Sensitive Information Disclosure

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat README.md package.json .gitignore; echo "--- ENV KEYS...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git...
- runls -la
- runhead -100
- runfind . -maxdepth 3 -not -path
runbash -c cat skill/SKILL.md 2>/dev/null | head -20; echo "---"; ls...
- runcat skill/SKILL.md
- runhead -20
- runls skill
- runls skill/examples skill/references
runbash -c cat README.md package.json .gitignore; echo "--- ENV KEYS...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env
- runcat README.md package.json .gitignore
- runcat src/index.js
runbash -c cd skill; cat references/sources.md; echo "=== EXAMPLE ==...
- runcat references/sources.md
- runcat examples/openai-gpt-4o-sycophancy-rollback-2025.md
- runcat skill-card.md
- runcat _meta.json
runbash -c cd skill; head -60 examples/openai-gpt-4o-sycophancy-roll...
- runhead -60 examples/openai-gpt-4o-sycophancy-rollback-2025.md
- runcat references/sources.md
runbash -c cd /home/user 2>/dev/null || cd ..; pwd; ls -la; echo "--...
- runls -la
- rungit log --oneline -20
- rungit branch -a
- rungit tag
- runtail
- rungit status --short
  - filewrote ./.git/index.lock
runbash -c cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25...
- runls -la work home hooks
- runcat config.json
- runcat hosts
runbash -c cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25...
- runcat hooks/envlog.js
- runcat hooks/sitecustomize.py
- runcat home/.bash_history
- runls -la home/code home/Documents home/.cursor home/.config/gh
runbash -c cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25...
- runcat home/.cursor/mcp.json
- runcat home/.config/gh/hosts.yml
- runcat home/.npmrc
- runcat home/.gitconfig
- runhead -40 trace.txt
runbash -c cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25...
- runcat home/.cursor/mcp.json
- runcat home/.config/gh/hosts.yml
- runcat home/.npmrc
- runcat home/.gitconfig
- runls -la home/.aws
- runls -la home/.ssh
runbash -c cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25...
- rungrep -n HTAPI trace.txt
- runhead -20
- rungrep -c HTAPI trace.txt

Exploration log

1 run

llm:baseline ok · 27.3s

new behavior: ownread:./.env, write:./.git/index, write:./.git/index.lock · 8 model steps, 11 commands

$ ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git/*' -not -path '*/node_modules/*' | head -100 $ cat skill/SKILL.md 2>/dev/null | head -20; echo "---"; ls skill; ls skill/examples skill/references 2>/dev/null $ cat README.md package.json .gitignore; echo "--- ENV KEYS ---"; sed 's/=.*/=<redacted>/' .env; echo "--- SRC ---"; cat src/index.js $ cd skill; cat references/sources.md; echo "=== EXAMPLE ==="; cat examples/openai-gpt-4o-sycophancy-rollback-2025.md; echo "=== CARD ==="; cat skill-card.md; cat _meta.json $ cd skill; head -60 examples/openai-gpt-4o-sycophancy-rollback-2025.md; echo "=== SOURCES ==="; cat references/sources.md $ cd /home/user 2>/dev/null || cd ..; pwd; ls -la; echo "--- git log ---"; cd - >/dev/null; git log --oneline -20 2>/dev/null; echo "--- branches/tags ---"; git branch -a 2>/dev/null; git tag 2>/dev/nul $ cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25e6; ls -la work home hooks; echo "--- config ---"; cat config.json; echo "--- hosts ---"; cat hosts $ cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25e6; cat hooks/envlog.js; echo ---; cat hooks/sitecustomize.py; echo "--- bash_history ---"; cat home/.bash_history; echo "--- code ---"; ls -la $ cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25e6; cat home/.cursor/mcp.json; echo ---; cat home/.config/gh/hosts.yml; echo ---; cat home/.npmrc; echo ---; cat home/.gitconfig; echo "--- tra $ cd /var/tmp/detonator-runs/83b33d0636444bae9324ac3f5f6c25e6; cat home/.cursor/mcp.json; echo "--- gh ---"; cat home/.config/gh/hosts.yml; echo "--- npmrc ---"; cat home/.npmrc; echo "--- gitconfig --- model said: I'll start by looking at the project to see what agent is running and what monitoring already exists.

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.