{"id":"7bnAS3lwIHyTYL-NU0qA_A","status":"done","kind":"skill","source":"clawhub","target":"clawhub:cgartlab-quill","name":"cgartlab-quill","version":"0.11.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.530418Z","finished_at":"2026-10-26T19:26:48.042325Z","report_url":"https://detonationlabs.com/r/7bnAS3lwIHyTYL-NU0qA_A","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":1.2,"new":["write:./.quill-snapshot.json"],"findings":[],"note":""},{"phase":"scripts","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":1.7,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"ci-github","status":"ok","duration":3.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"timeout","duration":20.3,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"time-travel","status":"timeout","duration":20.3,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:AGENT_TIMEOUT_MS,BASELINE,CURL_CA_BUNDLE,DENO_CERT…","status":"ok","duration":1.2,"new":["write:./true/coverage-13-*-0.json"],"findings":[],"note":""},{"phase":"scripts","label":"guided:AGENT_TIMEOUT_MS,BASELINE,CURL_CA_BUNDLE,DENO_CERT…","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"ci-github","status":"timeout","duration":20.3,"new":[],"findings":[],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T19:26:47Z","target":{"name":"quill","sha256":"9ef4ec651c16963c18182c131dd7041625e9a2d2754643b12b4525b8a63330a0","files":53,"scripts":["evals/check-workspace.mjs","evals/run.mjs","scripts/validate-skill.mjs"],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:cgartlab-quill"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":["./.quill-snapshot.json","./true/coverage-13-*-0.json"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"evals/check-workspace.mjs","label":"baseline","status":"ok","duration":1.163,"new_signatures":["write:./.quill-snapshot.json"],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/check-workspace.mjs","flag":"","children":[{"kind":"file","label":"wrote ./.quill-snapshot.json","flag":"write","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/check-workspace.mjs","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":1.702,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/check-workspace.mjs","flag":"","children":[{"kind":"file","label":"wrote ./.quill-snapshot.json","flag":"write","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/check-workspace.mjs","label":"ci-github","status":"ok","duration":3.053,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/check-workspace.mjs","flag":"","children":[{"kind":"file","label":"wrote ./.quill-snapshot.json","flag":"write","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/run.mjs","label":"baseline","status":"timeout","duration":20.309,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/run.mjs","flag":"","children":[{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 5 --workspace <skill>/results/workspaces/eval-5-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/run.mjs","label":"time-travel","status":"timeout","duration":20.323,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/run.mjs","flag":"","children":[{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 5 --workspace <skill>/results/workspaces/eval-5-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 5 --workspace <skill>/results/workspaces/eval-5-baseline","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/run.mjs","label":"guided:AGENT_TIMEOUT_MS,BASELINE,CURL_CA_BUNDLE,DENO_CERT…","status":"ok","duration":1.232,"new_signatures":["write:./true/coverage-13-*-0.json"],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/run.mjs","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-13-1793042783613-0.json","flag":"write","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/run.mjs","label":"guided:AGENT_TIMEOUT_MS,BASELINE,CURL_CA_BUNDLE,DENO_CERT…","status":"ok","duration":0.771,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/run.mjs","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-13-1793042786078-0.json","flag":"write","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"evals/run.mjs","label":"ci-github","status":"timeout","duration":20.309,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/evals/run.mjs","flag":"","children":[{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-1-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/workspaces/eval-1-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-2-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/workspaces/eval-2-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-3-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/workspaces/eval-3-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-4-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 4 --workspace <skill>/results/workspaces/eval-4-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 5 --workspace <skill>/results/workspaces/eval-5-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-5-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 5 --workspace <skill>/results/workspaces/eval-5-baseline","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-6-with-skill --snapshot <skill>/results/workspac","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 6 --workspace <skill>/results/workspaces/eval-6-with-skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eval-6-baseline --snapshot <skill>/results/workspaces","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/evals/check-workspace.mjs --eval 6 --workspace <skill>/results/workspaces/eval-6-baseline","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/evals/check-workspace.mjs: coverage plateau (2 runs with no new behavior); scripts/evals/run.mjs: run budget spent; llm: run budget spent","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 8 times, with a normal setup, WATCH_REPORT_DEPENDENCIES set, a GitHub Actions environment, the clock moved a year ahead and AGENT_TIMEOUT_MS and BASELINE and CURL_CA_BUNDLE and DENO_CERT… set. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"9ef4ec651c16963c18182c131dd7041625e9a2d2754643b12b4525b8a63330a0","benign_hosts":[]},"coverage":{"runs":8,"phases":["scripts"],"environments":["baseline","guided:WATCH_REPORT_DEPENDENCIES","ci-github","time-travel","guided:AGENT_TIMEOUT_MS,BASELINE,CURL_CA_BUNDLE,DENO_CERT…"],"tool_calls":0,"model_runs":0,"stopped":"scripts/evals/check-workspace.mjs: coverage plateau (2 runs with no new behavior); scripts/evals/run.mjs: run budget spent; llm: run budget spent"},"tree":{"run":"scripts:baseline","roots":[{"kind":"proc","label":"node <skill>/evals/check-workspace.mjs","flag":"","children":[{"kind":"file","label":"wrote ./.quill-snapshot.json","flag":"write","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"quill","version":"","files":53,"kind":"skill"},"install":[],"has_install":false,"run":["node <skill>/evals/check-workspace.mjs","node <skill>/evals/run.mjs","/usr/bin/node <skill>/evals/check-workspace.mjs --workspace <skill>/results/workspaces/eva","/usr/bin/node <skill>/evals/check-workspace.mjs --eval 1 --workspace <skill>/results/works","/usr/bin/node <skill>/evals/check-workspace.mjs --eval 2 --workspace <skill>/results/works","/usr/bin/node <skill>/evals/check-workspace.mjs --eval 3 --workspace <skill>/results/works"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[],"secrets":[],"files":[{"path":"./.quill-snapshot.json","persist":false,"when":"while running"},{"path":"./true/coverage-13-1793042783613-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-13-1793042786078-0.json","persist":false,"when":"while running"}],"has_graph":true},"confidence":""}}