Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: taplio-linkedin-niche-creator-finder
Source: clawhub 1.0.0
SHA-256: 30333ff6657856dd
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs

Package linkedin-niche-creator-finder 3 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -la ./skillhead -5cat ./skill/SKILL.mdls -la An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cut)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat ./skill/_meta.json; echo "---"; cat ./README.md; echo...
- runcut -d= -f1 .env
  - secretread ./.env

View full process tree

runbash -c ls -la ./skill 2>/dev/null; echo "---"; cat ./skill/SKILL...
- runls -la ./skill
- runhead -5
- runcat ./skill/SKILL.md
- runls -la
runbash -c cat ./skill/_meta.json; echo "---"; cat ./README.md; echo...
- runcut -d= -f1 .env
  - secretread ./.env
- runcat ./skill/_meta.json
- runcat ./README.md
- runcat ./package.json
- runls -la ./src
- runcat .gitignore
runbash -c which claude 2>/dev/null; ls ~/.claude* 2>/dev/null; ls ~...
- runwhich claude
- runls ~/.claude*
- runls ~/.config
- rungrep -i -E mcp|taplio
- runsed s/=.*/=<set>/
- runenv

Exploration log

4 runs

obedient:baseline ok · 0.8s

no new behavior

$ TOP 8 CREATORS IN [niche] 1. [Name] Profile : linkedin.com/in/[handle] (if known, otherwise leave blank) Angle : [specific corner of the niche] Formats : [main format mix] Frequency : [pos $ HOW TO USE THIS LIST - Pick 3 to model. Read their last 30 posts each. - Note the hooks they reuse, the structure they repeat, the topics they own. - Comment on their posts daily for 2 weeks to enter
obedient:ci-github ok · 0.7s

no new behavior

$ TOP 8 CREATORS IN [niche] 1. [Name] Profile : linkedin.com/in/[handle] (if known, otherwise leave blank) Angle : [specific corner of the niche] Formats : [main format mix] Frequency : [pos $ HOW TO USE THIS LIST - Pick 3 to model. Read their last 30 posts each. - Note the hooks they reuse, the structure they repeat, the topics they own. - Comment on their posts daily for 2 weeks to enter
obedient:cloud-creds ok · 0.5s

no new behavior

$ TOP 8 CREATORS IN [niche] 1. [Name] Profile : linkedin.com/in/[handle] (if known, otherwise leave blank) Angle : [specific corner of the niche] Formats : [main format mix] Frequency : [pos $ HOW TO USE THIS LIST - Pick 3 to model. Read their last 30 posts each. - Note the hooks they reuse, the structure they repeat, the topics they own. - Comment on their posts daily for 2 weeks to enter
llm:baseline ok · 9.0s

new behavior: ownread:./.env · 4 model steps, 3 commands

$ ls -la ./skill 2>/dev/null; echo "---"; cat ./skill/SKILL.md 2>/dev/null | head -5; echo "---"; ls -la $ cat ./skill/_meta.json; echo "---"; cat ./README.md; echo "---"; cat ./package.json; echo "---"; ls -la ./src; echo "---"; cat .gitignore; echo "--- env keys:"; cut -d= -f1 .env $ which claude 2>/dev/null; ls ~/.claude* 2>/dev/null; ls ~/.config 2>/dev/null; env | grep -i -E "mcp|taplio" | sed 's/=.*/=<set>/'; echo "exit: done" model said: I can't run this skill: the Taplio MCP isn't connected in this environment. I checked for the Taplio tools (`get_me`, `search_inspiration`) and for any MCP configuration — none are available here, and the only tools I have are shell access to your `payments-api` project. Per the skill's rules, there's no plain-prompt fallback: without Taplio I'd just be guessing at creators instead of grounding t

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.