{"id":"61db507bf4ac","status":"done","kind":"auto","source":"clawhub","target":"clawhub:@matrixy/agent-browser-clawdbot","name":"agent-browser-clawdbot","version":"","verdict":"MALICIOUS BEHAVIOR OBSERVED","top_finding":"Secrets sent over the network via tcp/443 to registry.npmjs.org","findings":3,"critical":1,"public":true,"confidence":"Confirmed","created_at":"2026-10-26T15:09:38.668393Z","finished_at":"2026-10-26T15:10:27.518750Z","report_url":"https://detonationlabs.com/r/61db507bf4ac","progress":[{"phase":"obedient","label":"baseline","status":"ok","duration":19.5,"new":["dns:registry.npmjs.org","exfil:tcp/443","ownread:~/.npmrc","write:~/.npm/_cacache/content-v2/sha512/1d/ed/*","write:~/.npm/_cacache/index-v5/3d/cc/*"],"findings":[{"severity":"critical","title":"Secrets sent over the network via tcp/443 to registry.npmjs.org"},{"severity":"critical","title":"Secrets sent over the network via tcp/443 to registry.npmjs.org"}],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T15:10:12Z","target":{"name":"agent-browser","sha256":"a6c1e27139e924d4139a77ff48ba65c108bcb0ea7d0063a99b4f1ee3079b23d4","files":3,"scripts":[],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:@matrixy/agent-browser-clawdbot"},"verdict":"MALICIOUS BEHAVIOR OBSERVED","observed":{"network":["registry.npmjs.org"],"files_written":["~/.npm/_cacache/content-v2/sha512/1d/ed/*","~/.npm/_cacache/index-v5/3d/cc/*","~/.npm/_cacache/tmp/b5af7744","~/.npm/_logs/*-debug-0.log","~/.npm/_update-notifier-last-checked"],"secrets_read":[],"commands":[],"exfiltration":["tcp/443"]},"findings":[{"rule":"secret-exfiltration","severity":"critical","title":"Secrets sent over the network via tcp/443 to registry.npmjs.org","evidence":["~/.npmrc (npm) left the sandbox"],"run_label":"obedient:baseline","confidence":"Confirmed","confidence_reason":"A unique honeytoken marker was found in data the package sent out.","why":"On a real machine this would hand an attacker working credentials.","technique":"T1041 Exfiltration over C2 channel","description":"The package transmitted the contents of a credential file to a network destination. Before every run Detonator plants decoy credentials (AWS keys, SSH private key, npm and GitHub tokens, a .env file), each carrying a unique per-run marker. That marker was recovered from outbound traffic captured by the sandbox's network sink, after decoding (base64, hex, URL encoding, chunked DNS labels). This is direct proof that credential material left the process, not an inference from code.","impact":"On a developer workstation or CI runner this hands the operator of the destination host working credentials: registry tokens allow publishing malicious versions of your packages (a worm-style supply chain compromise), cloud keys allow resource abuse and data access, and SSH keys allow lateral movement to every host that trusts them.","remediation":"Do not install. If it was installed anywhere, treat every credential readable by that user as compromised: revoke and reissue npm/PyPI/GitHub tokens, rotate cloud keys, replace SSH keys, and review registry publish history and cloud audit logs for the exposure window. Block the destination host at egress and search proxy/DNS logs for other machines that contacted it.","references":["CWE-506 Embedded Malicious Code","CWE-200 Exposure of Sensitive Information","ATT&CK T1552.001 Credentials in Files","ATT&CK T1041 Exfiltration Over C2 Channel","OWASP MCP01:2025 Token Mismanagement & Secret Exposure"]},{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["registry.npmjs.org"],"run_label":"obedient:baseline","confidence":"Info","confidence_reason":"The package connected to these hosts.","why":"Common for tools that fetch data. Check that the hosts fit what the package says it does.","technique":"","description":"Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.","impact":"Context only. Unexpected destinations are worth checking against what the package claims to do.","remediation":"Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.","references":[]},{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"obedient:baseline","confidence":"Info","confidence_reason":"A tool opened its own login or config file, such as npm reading ~/.npmrc.","why":"Normal: that is how the tool works. Listed so nothing is hidden.","technique":"","description":"A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.","impact":"None in itself: this is how those tools work. Listed so the report shows every credential access.","remediation":"No action needed.","references":[]}],"exploration":{"runs":[{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":19.491,"new_signatures":["dns:registry.npmjs.org","exfil:tcp/443","ownread:~/.npmrc","write:~/.npm/_cacache/content-v2/sha512/1d/ed/*","write:~/.npm/_cacache/index-v5/3d/cc/*","write:~/.npm/_cacache/tmp/b5af7744","write:~/.npm/_logs/*-debug-0.log","write:~/.npm/_update-notifier-last-checked"],"findings":3,"note":"","commands":["agent-browser open https://example.com\nagent-browser snapshot -i --json\nagent-browser click @e2\nagent-browser fill @e3 \"text\"\nagent-browser snapshot -i --json","agent-browser open <url>\nagent-browser back | forward | reload | close","agent-browser snapshot -i --json          # Interactive elements, JSON output\nagent-browser snapshot -i -c -d 5 --json  # + compact, depth limit\nagent-browser snapshot -s \"#main\" -i      # Scope to se","agent-browser click @e2\nagent-browser fill @e3 \"text\"\nagent-browser type @e3 \"text\"\nagent-browser hover @e4\nagent-browser check @e5 | uncheck @e5\nagent-browser select @e6 \"value\"\nagent-browser press \"","agent-browser get text @e1 --json\nagent-browser get html @e2 --json\nagent-browser get value @e3 --json\nagent-browser get attr @e4 \"href\" --json\nagent-browser get title --json\nagent-browser get url --j","agent-browser is visible @e2 --json\nagent-browser is enabled @e3 --json\nagent-browser is checked @e4 --json","agent-browser wait @e2                    # Wait for element\nagent-browser wait 1000                   # Wait ms\nagent-browser wait --text \"Welcome\"       # Wait for text\nagent-browser wait --url \"**/","agent-browser --session admin open site.com\nagent-browser --session user open site.com\nagent-browser session list","agent-browser state save auth.json        # Save cookies/storage\nagent-browser state load auth.json        # Load (skip login)","agent-browser screenshot page.png\nagent-browser screenshot --full page.png\nagent-browser pdf page.pdf","agent-browser network route \"**/ads/*\" --abort           # Block\nagent-browser network route \"**/api/*\" --body '{\"x\":1}'  # Mock\nagent-browser network requests --filter api              # View","agent-browser cookies                     # Get all\nagent-browser cookies set name value\nagent-browser storage local key           # Get localStorage\nagent-browser storage local set key val","agent-browser tab new https://example.com\nagent-browser tab 2                       # Switch to tab\nagent-browser frame @e5                   # Switch to iframe\nagent-browser frame main               ","agent-browser open https://www.google.com\nagent-browser snapshot -i --json\nagent-browser fill @e1 \"AI agents\"\nagent-browser press Enter\nagent-browser wait --load networkidle\nagent-browser snapshot -i ","agent-browser --session admin open app.com\nagent-browser --session admin state load admin-auth.json\nagent-browser --session admin snapshot -i --json\nagent-browser --session user open app.com\nagent-bro"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c agent-browser open https://example.com\nagent-browser snap...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser open <url>\nagent-browser back | forward | r...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser snapshot -i --json          # Interactive e...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser click @e2\nagent-browser fill @e3 \"text\"\nage...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser get text @e1 --json\nagent-browser get html ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser is visible @e2 --json\nagent-browser is enab...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser wait @e2                    # Wait for elem...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser --session admin open site.com\nagent-browser...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser state save auth.json        # Save cookies/...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser screenshot page.png\nagent-browser screensho...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser network route \"**/ads/*\" --abort           ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser cookies                     # Get all\nagent...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser tab new https://example.com\nagent-browser t...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser open https://www.google.com\nagent-browser s...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser --session admin open app.com\nagent-browser ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c npm install -g agent-browser\nagent-browser install       ...","flag":"","children":[{"kind":"proc","label":"npm install -g agent-browser","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm install -g agent-browser","flag":"","children":[{"kind":"net","label":"registry.npmjs.org:443  sent 436 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true},{"kind":"net","label":"registry.npmjs.org:443  sent 400 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true},{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"DNS lookups for npmjs.org  2 queries","flag":"","children":[],"hot":false}],"hot":true}],"hot":true}],"hot":true}],"truncated":0}}],"stopped":"obedient: stopped early: secret exfiltration confirmed","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"~/.npmrc (npm) left the package on a normal run, headed for registry.npmjs.org. The sandbox caught it; nothing reached the internet.","recommendation":{"action":"Block","text":"Do not install. If it is already installed, remove it and rotate any credentials it could reach."},"iocs":{"hosts":[],"ips":[],"sha256":"a6c1e27139e924d4139a77ff48ba65c108bcb0ea7d0063a99b4f1ee3079b23d4","benign_hosts":["registry.npmjs.org"]},"coverage":{"runs":1,"phases":["obedient"],"environments":["baseline"],"tool_calls":0,"model_runs":0,"stopped":"obedient: stopped early: secret exfiltration confirmed"},"tree":{"run":"obedient:baseline","roots":[{"kind":"proc","label":"bash -c agent-browser open https://example.com\nagent-browser snap...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser open <url>\nagent-browser back | forward | r...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser snapshot -i --json          # Interactive e...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser click @e2\nagent-browser fill @e3 \"text\"\nage...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser get text @e1 --json\nagent-browser get html ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser is visible @e2 --json\nagent-browser is enab...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser wait @e2                    # Wait for elem...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser --session admin open site.com\nagent-browser...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser state save auth.json        # Save cookies/...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser screenshot page.png\nagent-browser screensho...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser network route \"**/ads/*\" --abort           ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser cookies                     # Get all\nagent...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser tab new https://example.com\nagent-browser t...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser open https://www.google.com\nagent-browser s...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c agent-browser --session admin open app.com\nagent-browser ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c npm install -g agent-browser\nagent-browser install       ...","flag":"","children":[{"kind":"proc","label":"npm install -g agent-browser","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm install -g agent-browser","flag":"","children":[{"kind":"net","label":"registry.npmjs.org:443  sent 436 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true},{"kind":"net","label":"registry.npmjs.org:443  sent 400 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true},{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"DNS lookups for npmjs.org  2 queries","flag":"","children":[],"hot":false}],"hot":true}],"hot":true}],"hot":true}],"preview":[{"kind":"proc","label":"bash -c npm install -g agent-browser\nagent-browser install       ...","flag":"","children":[{"kind":"proc","label":"npm install -g agent-browser","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm install -g agent-browser","flag":"","children":[{"kind":"net","label":"registry.npmjs.org:443  sent 436 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true},{"kind":"net","label":"registry.npmjs.org:443  sent 400 B  carrying ~/.npmrc","flag":"leak","children":[],"hot":true}],"hot":true}],"hot":true}],"hot":true}],"truncated":0},"flow":{"package":{"name":"agent-browser","version":"matrixy/agent-browser-clawdbot","files":3,"kind":"skill"},"install":[],"has_install":true,"run":[],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[{"host":"registry.npmjs.org","conns":2,"bytes":836,"leak":"~/.npmrc","when":"during install","dns":false}],"secrets":[{"path":"~/.npmrc","own":true,"when":"during install","leaked":true}],"files":[],"has_graph":true},"confidence":"Confirmed","reproduction":{"runs":2,"reproduced_runs":2,"reproduced":true,"rules":["secret-exfiltration"]}}}