{"id":"4C9jfE9GlUZ0YNVjvcfZRg","status":"done","kind":"skill","source":"clawhub","target":"clawhub:tencent-news-sports-schedule","name":"tencent-news-sports-schedule","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.560768Z","finished_at":"2026-10-26T19:37:25.874116Z","report_url":"https://detonationlabs.com/r/4C9jfE9GlUZ0YNVjvcfZRg","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:APIKEY_ERROR=null","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:APIKEY_STATUS=configured","status":"ok","duration":0.6,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":0.9,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"docs:status","status":"ok","duration":1.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:APIKEY_ERROR=null","status":"ok","duration":1.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":0.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:APIKEY_ERROR=null","status":"ok","duration":0.6,"new":[],"findings":[],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T19:37:25Z","target":{"name":"tencent-news-sports-schedule","sha256":"1f5f5526b6c05fc3034a06650d048aa00bb59da67ea3af1c7a297184d2dc5298","files":16,"scripts":["scripts/cli-runtime.sh","scripts/cli-state.sh","scripts/run-cli.sh"],"declared":{},"trigger_hints":["schedule","Schedule"],"kind":"skill","source":"clawhub:tencent-news-sports-schedule"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/cli-runtime.sh","label":"baseline","status":"ok","duration":0.439,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-runtime.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/cli-runtime.sh","label":"guided:APIKEY_ERROR=null","status":"ok","duration":0.386,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-runtime.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/cli-runtime.sh","label":"guided:APIKEY_STATUS=configured","status":"ok","duration":0.577,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-runtime.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/cli-state.sh","label":"baseline","status":"ok","duration":0.891,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-state.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/cli-state.sh","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"uname -s","flag":"","children":[],"hot":false},{"kind":"proc","label":"uname -m","flag":"","children":[],"hot":false},{"kind":"proc","label":"sed s/\\\\/\\\\\\\\/g; s/\"/\\\\\"/g; s/\t/\\\\t/g","flag":"","children":[],"hot":false},{"kind":"proc","label":"tr \\r\\n   ","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/cli-state.sh","label":"docs:status","status":"ok","duration":1.074,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-state.sh status","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/cli-state.sh","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"uname -s","flag":"","children":[],"hot":false},{"kind":"proc","label":"uname -m","flag":"","children":[],"hot":false},{"kind":"proc","label":"sed s/\\\\/\\\\\\\\/g; s/\"/\\\\\"/g; s/\t/\\\\t/g","flag":"","children":[],"hot":false},{"kind":"proc","label":"tr \\r\\n   ","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/cli-state.sh","label":"guided:APIKEY_ERROR=null","status":"ok","duration":1.125,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-state.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/cli-state.sh","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"uname -s","flag":"","children":[],"hot":false},{"kind":"proc","label":"uname -m","flag":"","children":[],"hot":false},{"kind":"proc","label":"sed s/\\\\/\\\\\\\\/g; s/\"/\\\\\"/g; s/\t/\\\\t/g","flag":"","children":[],"hot":false},{"kind":"proc","label":"tr \\r\\n   ","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/run-cli.sh","label":"baseline","status":"ok","duration":0.548,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/run-cli.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/run-cli.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/run-cli.sh","label":"guided:APIKEY_ERROR=null","status":"ok","duration":0.599,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/run-cli.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/run-cli.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/cli-runtime.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/cli-state.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/run-cli.sh: run budget spent; llm: run budget spent","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 8 times, with a normal setup, APIKEY_ERROR=null set, APIKEY_STATUS=configured set and docs:status. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"1f5f5526b6c05fc3034a06650d048aa00bb59da67ea3af1c7a297184d2dc5298","benign_hosts":[]},"coverage":{"runs":8,"phases":["scripts"],"environments":["baseline","guided:APIKEY_ERROR=null","guided:APIKEY_STATUS=configured","docs:status"],"tool_calls":0,"model_runs":0,"stopped":"scripts/scripts/cli-runtime.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/cli-state.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/run-cli.sh: run budget spent; llm: run budget spent"},"tree":{"run":"scripts:baseline","roots":[{"kind":"proc","label":"bash <skill>/scripts/cli-runtime.sh","flag":"","children":[],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"tencent-news-sports-schedule","version":"","files":16,"kind":"skill"},"install":[],"has_install":false,"run":["bash <skill>/scripts/cli-runtime.sh","bash <skill>/scripts/cli-state.sh","dirname <skill>/scripts/cli-state.sh","uname -s","uname -m","sed s/\\\\/\\\\\\\\/g; s/\"/\\\\\"/g; s/\t/\\\\t/g"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[],"secrets":[],"files":[],"has_graph":true},"confidence":""}}