Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It contacted github.com. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: frame-security-scan
Source: clawhub 1.0.0
SHA-256: 5353595d4fda7fc8
Files: 4

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs

Package frame-security-scan 4 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lawhich -a framegrep -i framels /usr/local/bin /usr/bin An AI agent also used it 1 time.
What it reached
Network
- github.com 2 connections, 418 B sent
Credentials
None of the planted fake keys were touched.

Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: llm:baseline

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

github.com

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c frame --version; echo "---"; frame scan --help; echo "---...
- runls -la
runbash -c which -a frame; ls /usr/local/bin /usr/bin 2>/dev/null | ...
- runwhich -a frame
- rungrep -i frame
- runls /usr/local/bin /usr/bin
- runpip show frame
- runhead -2
- runpython3 -c import frame
- runcat README.md
- runcat package.json
- runls -R src skill
- runhead -40
runbash -c cd /tmp && timeout 20 git ls-remote https://github.com/la...
- runtimeout 20 git ls-remote https://github.com/lambdasec/frame
  - rungit ls-remote https://github.com/lambdasec/frame
    - run/usr/lib/git-core/git remote-https https://github.com/lambdasec/frame https://github.com/lambdasec/frame
      - run/usr/lib/git-core/git-remote-https https://github.com/lambdasec/frame https://github.com/lambdasec/frame
        netgithub.com:443 sent 236 B
        netgithub.com:443 sent 182 B
        netDNS lookups for github.com 2 queries
- runhead -3

Exploration log

4 runs

obedient:baseline ok · 1.0s

no new behavior

$ frame --version frame scan --help $ frame scan app.py # one file frame scan src/ --pattern "**/*.py" # a directory frame scan src/ -f json -o findings.json # machine-readable, for later steps $ export FRAME_LLM_BASE_URL=http://localhost:8080/v1 # your endpoint export FRAME_LLM_API_KEY= # empty for local servers export FRAME_LLM_MODEL=<model name your endpoint ser $ frame fix src/ --guidance findings.json --diff $ frame scan src/ -f json -o findings-after.json
obedient:ci-github ok · 0.9s

no new behavior

$ frame --version frame scan --help $ frame scan app.py # one file frame scan src/ --pattern "**/*.py" # a directory frame scan src/ -f json -o findings.json # machine-readable, for later steps $ export FRAME_LLM_BASE_URL=http://localhost:8080/v1 # your endpoint export FRAME_LLM_API_KEY= # empty for local servers export FRAME_LLM_MODEL=<model name your endpoint ser $ frame fix src/ --guidance findings.json --diff $ frame scan src/ -f json -o findings-after.json
obedient:cloud-creds ok · 0.8s

no new behavior

$ frame --version frame scan --help $ frame scan app.py # one file frame scan src/ --pattern "**/*.py" # a directory frame scan src/ -f json -o findings.json # machine-readable, for later steps $ export FRAME_LLM_BASE_URL=http://localhost:8080/v1 # your endpoint export FRAME_LLM_API_KEY= # empty for local servers export FRAME_LLM_MODEL=<model name your endpoint ser $ frame fix src/ --guidance findings.json --diff $ frame scan src/ -f json -o findings-after.json
llm:baseline ok · 16.8s

new behavior: dns:github.com · 4 model steps, 3 commands

$ frame --version; echo "---"; frame scan --help; echo "---"; ls -la $ which -a frame; ls /usr/local/bin /usr/bin 2>/dev/null | grep -i frame; pip show frame 2>/dev/null; python3 -c "import frame" 2>&1 | head -2; echo "---"; cat README.md; echo "---"; cat package.json; e $ cd /tmp && timeout 20 git ls-remote https://github.com/lambdasec/frame 2>&1 | head -3; echo "exit=$?" model said: I stopped before running a scan, because two things block it. **1. Frame is not installed.** `frame --version` and `frame scan --help` both return `command not found`, and it isn't in `/usr/local/bin`, `/usr/bin`, or the Python environment. The skill says not to install it for you, so I haven't. To continue, install it yourself following the steps in the project README (github.com/lambdasec/frame

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.