Verdict

No malicious behavior observed

We ran it 8 times, with a normal setup, ANDROID_DATA and APPENGINE_RUNTIME and CURL_CA_BUNDLE and DEB_PYTHON_INSTALL_LAYOUT… set, the environment variables it says it needs, SCAVIO_API_KEY set and cloud credentials present. It contacted api.scavio.dev and registry.npmjs.org. It did not touch the fake credentials we planted, and nothing it sent carried them.

4 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: heb-grocery-data
Source: clawhub 1.0.0
SHA-256: 04053dc68b759e26
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 8 runs

Package heb-grocery-data 3 files · agent skill
Install No install scripts of its ownOnly the package manager ran.
Runs as curl -X POST https://api.scavio.dev/api/v1/heb/search -H Authorization: Bearer curl -X POST https://api.scavio.dev/api/v1/heb/search -H Authorization: Bearer HTENVKkwD7zcurl -X POST https://api.scavio.dev/api/v1/heb/search -H Authorization: Bearer HTENVOmjaPJcurl -X POST https://api.scavio.dev/api/v1/heb/search -H Authorization: Bearer HTENV1YtcFu
What it reached
Network
- api.scavio.dev 4 connections, 906 B sent
- registry.npmjs.org 44 connections, 15.4 KB sent · during install
Credentials
None of the planted fake keys were touched.

~/.npmrc read by its own tool (normal)

Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Used the planted login with its own service (registry.npmjs.org)

Confidence: Info A planted login went to the service it belongs to, as normal authentication (npm sending its token to registry.npmjs.org while installing).
Observed in: obedient:baseline

Description

A planted login was sent to the service it belongs to, only as the Authorization header of ordinary requests: for example npm sending the ~/.npmrc token to registry.npmjs.org while installing dependencies.

Impact

None in itself: this is how the package manager authenticates. Publishing, unpublishing or creating tokens with it would be reported as exfiltration.

Evidence

~/.npmrc (npm) sent only as the login header of ordinary requests (no publish)

Remediation

No action needed.

F02 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: obedient:baseline

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

api.scavio.dev

registry.npmjs.org

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F03 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence: Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in: obedient:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

F04 Low

The fake credential we configured was sent to its API (expected)

Confidence: Info The fake API key we configured to start the server was sent to its own service.
Observed in: obedient:declared-env

Description

A fake credential Detonator configured to start the server was sent to its own API.

Impact

Expected for servers that wrap an online service.

Evidence

$SCAVIO_API_KEY: sent to api.scavio.dev

Remediation

Confirm the host is the service the key belongs to.

Process tree

run obedient:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c export SCAVIO_API_KEY=sk_live_your_key
runbash -c Authorization: Bearer $SCAVIO_API_KEY
runbash -c curl -X POST https://api.scavio.dev/api/v1/heb/search \ ...
- runcurl -X POST https://api.scavio.dev/api/v1/heb/search -H Authorization: Bearer
  - netapi.scavio.dev:443 sent 212 B
runbash -c pip install scavio==0.18.0
- runpip install scavio==0.18.0
runbash -c npm install [email protected]
- runnpm install [email protected]
  - runnode /usr/bin/npm install [email protected]
    - secretread ~/.npmrc (its own config)
    - netregistry.npmjs.org:443 sent 436 B
    - netregistry.npmjs.org:443 sent 388 B
    - netregistry.npmjs.org:443 sent 378 B
    - netregistry.npmjs.org:443 sent 386 B ×2
    - netDNS lookups for npmjs.org, scavio.dev 4 queries

Exploration log

8 runs

obedient:baseline ok · 21.5s

new behavior: dns:api.scavio.dev, dns:registry.npmjs.org, exec:curl, ownread:~/.npmrc

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 19.4s

new behavior: write:~/.npm/_cacache/content-v2/sha512/2c/61/*, write:~/.npm/_cacache/tmp/*a, write:~/.npm/_cacache/tmp/21503b3a, write:~/.npm/_cacache/tmp/7eb72984

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 21.6s

new behavior: write:~/.npm/_cacache/content-v2/sha512/f0/90/*, write:~/.npm/_cacache/tmp/492ba3de, write:~/.npm/_cacache/tmp/4bdbab9e, write:~/.npm/_cacache/tmp/69274d68

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:declared-env ok · 18.8s

new behavior: handover:config-secret-egress, write:~/.npm/_cacache/content-v2/sha512/92/6e/*, write:~/.npm/_cacache/tmp/*a2, write:~/.npm/_cacache/tmp/833ff8bf

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,CURL_CA_BUNDLE,DEB_PYTHON_INSTALL_LAYOUT… ok · 17.6s

new behavior: write:~/.npm/_cacache/content-v2/sha512/28/8f/*, write:~/.npm/_cacache/tmp/0a048ecd, write:~/.npm/_cacache/tmp/1ad8a319, write:~/.npm/_cacache/tmp/9c5a9d45

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:guided:SCAVIO_API_KEY ok · 24.0s

new behavior: write:~/.npm/_cacache/content-v2/sha512/d2/f3/*, write:~/.npm/_cacache/tmp/*a7, write:~/.npm/_cacache/tmp/0c39ed5b, write:~/.npm/_cacache/tmp/1e58b418

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:cloud-creds ok · 18.3s

new behavior: write:~/.npm/_cacache/content-v2/sha512/7c/a1/*, write:~/.npm/_cacache/tmp/0d75a731, write:~/.npm/_cacache/tmp/0e78f9d7, write:~/.npm/_cacache/tmp/e8eb2a0d

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]
obedient:guided:ANDROID_DATA,APPENGINE_RUNTIME,AWS_ACCESS_KEY_ID,AWS_REGION… ok · 18.4s

new behavior: write:~/.npm/_cacache/content-v2/sha512/f2/e1/*, write:~/.npm/_cacache/tmp/8602a62f, write:~/.npm/_cacache/tmp/d9a6c97f, write:~/.npm/_cacache/tmp/e055e12f

$ export SCAVIO_API_KEY=sk_live_your_key $ Authorization: Bearer $SCAVIO_API_KEY $ curl -X POST https://api.scavio.dev/api/v1/heb/search \ -H "Authorization: Bearer $SCAVIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "organic milk", "page_size": 5}' $ pip install scavio==0.18.0 $ npm install [email protected]

obedient: run budget spent; llm: run budget spent

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.