Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: ui-engineering
Source: clawhub 1.0.0
SHA-256: ed27121c576a633c
Files: 67

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs

Package ui-engineering 67 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lals -la skillls skill/referenceshead -100 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat package.json; echo "---"; cat README.md; echo "---"; ...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; ls -la skill; echo "---"; ls skill/re...
- runls -la
- runls -la skill
- runls skill/references
- runhead -100
runbash -c cat skill/references/_meta_registry.md
- runcat skill/references/_meta_registry.md
runbash -c cat package.json; echo "---"; cat README.md; echo "---"; ...
- runcat .env
  - secretread ./.env
- runcat package.json
- runcat README.md
- runcat .gitignore
- runls -la src
- runcat src/index.js
- runsed s/=.*/=<redacted>/
- rungit log --oneline
- runhead -20
runbash -c cat skill/README.md; echo "---"; cat skill/skill-card.md;...
- runcat skill/README.md
- runcat skill/skill-card.md
- runcat skill/_meta.json
runbash -c cat skill/references/stripe.md
- runcat skill/references/stripe.md
runbash -c cat skill/references/linear.md
- runcat skill/references/linear.md
runbash -c cd skill/references; for f in *.md; do echo "=== $f ($(wc...
- runwc -l ×39
- runhead -8 ×39
- runhead -c 400 _meta_registry.md
- runhead -c 400 active_theory.md
- runhead -c 400 aesop.md
- runhead -c 400 airbnb.md
- runhead -c 400 alibaba.md
- runhead -c 400 apple.md
- runhead -c 400 arc.md
- runhead -c 400 bilibili.md
- runhead -c 400 bruno_simon.md
- runhead -c 400 bytedance.md
- runhead -c 400 cash_app.md
- runhead -c 400 claude.md
- runhead -c 400 discord.md
- runhead -c 400 dji.md
- runhead -c 400 duolingo.md
- runhead -c 400 editorial.md
- runhead -c 400 figma.md
- runhead -c 400 flighty.md
- runhead -c 400 game_gris.md
- runhead -c 400 game_monument.md
- runhead -c 400 game_nier.md
- runhead -c 400 game_persona.md
- runhead -c 400 geek_hacker.md
- runhead -c 400 geek_primer.md
- runhead -c 400 geek_retro.md
- runhead -c 400 geek_tui.md
- runhead -c 400 gentler.md
- runhead -c 400 google.md
- runhead -c 400 ibm.md
- runhead -c 400 linear.md
- runhead -c 400 locomotive.md
- runhead -c 400 microsoft.md
- runhead -c 400 moma.md
- runhead -c 400 nasa.md
- runhead -c 400 nike.md
- runhead -c 400 nio.md
- runhead -c 400 notion.md
- runhead -c 400 nyt.md
- runhead -c 400 openai.md
runbash -c cd skill/references; cat stripe.md | head -40; echo "====...
- runhead -40
- runcat stripe.md
- runcat presentation_scroll.md
- runcat personal_blog.md
runbash -c cd skill/references; cat stripe.md; echo "=========="; ca...
- runcat stripe.md
- runcat presentation_scroll.md
runbash -c cd skill/references; cat stripe.md
- runcat stripe.md
runbash -c cd skill/references; head -c 1500 stripe.md; echo; echo "...
- runhead -c 1500 stripe.md
- runhead -c 1500 presentation_scroll.md

Exploration log

4 runs

obedient:baseline ok · 0.7s

no new behavior

$ ui-engineering/ ├── SKILL.md └── references/ ├── _meta_registry.md <- START HERE ├── apple.md ├── stripe.md ├── personal_blog.md ├── ... (60+ specs)
obedient:ci-github ok · 0.7s

no new behavior

$ ui-engineering/ ├── SKILL.md └── references/ ├── _meta_registry.md <- START HERE ├── apple.md ├── stripe.md ├── personal_blog.md ├── ... (60+ specs)
obedient:cloud-creds ok · 0.5s

no new behavior

$ ui-engineering/ ├── SKILL.md └── references/ ├── _meta_registry.md <- START HERE ├── apple.md ├── stripe.md ├── personal_blog.md ├── ... (60+ specs)
llm:baseline ok · 34.1s

new behavior: ownread:./.env · 8 model steps, 11 commands

$ ls -la; echo "---"; ls -la skill; echo "---"; ls skill/references | head -100 $ cat skill/references/_meta_registry.md $ cat package.json; echo "---"; cat README.md; echo "---"; cat .gitignore; echo "---"; ls -la src; echo "---"; for f in src/*; do echo "== $f"; cat "$f"; done; echo "---"; cat .env | sed 's/=.*/=<redact $ cat skill/README.md; echo "---"; cat skill/skill-card.md; echo "---"; cat skill/_meta.json $ cat skill/references/stripe.md $ cat skill/references/linear.md $ cd skill/references; for f in *.md; do echo "=== $f ($(wc -l < $f) lines)"; head -c 400 "$f" | head -8; echo; done $ cd skill/references; cat stripe.md | head -40; echo "=========="; cat presentation_scroll.md; echo "=========="; cat personal_blog.md $ cd skill/references; cat stripe.md; echo "=========="; cat presentation_scroll.md $ cd skill/references; cat stripe.md model said: I'll start by exploring the project and the skill's registry to understand what's available.

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.