Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

2 findings. Scanned 27 Oct 2026 by detonator 0.5.1.

Target: make-me-think
Source: clawhub 0.4.3
SHA-256: ef02d8e50e161d76
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 1 run

Package make-me-think 3 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lahead -100find . -maxdepth 3 -not -pathcat .env An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

F02 Low

Agent put secrets in the model's context (may be the agent's own choice)

Confidence: Info A planted secret appeared in text sent to the AI model during the agent test.
Observed in: llm:baseline

Description

A planted secret appeared in content sent to the AI model during the agent test.

Impact

The model provider saw the value; it did not leave through the package.

Evidence

./.env (dotenv)

Remediation

Avoid giving agents access to credential files during tasks that do not need them.

References

OWASP LLM02:2025 Sensitive Information Disclosure

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat README.md; echo "---PKG"; cat package.json; echo "---...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git...
- runls -la
- runhead -100
- runfind . -maxdepth 3 -not -path
runbash -c cat README.md; echo "---PKG"; cat package.json; echo "---...
- runcat .env
  - secretread ./.env
- runcat README.md
- runcat package.json
- runcat src/index.js
- runls -la skill
- runcat skill/SKILL.md skill/skill-card.md
runbash -c cat .gitignore; echo "---tracked?"; git ls-files | grep -...
- runcat .gitignore
- rungrep -n env
- rungit ls-files
- rungit log --oneline -- .env
- runhead

Exploration log

1 run

llm:baseline ok · 9.9s

new behavior: ownread:./.env · 4 model steps, 3 commands

$ ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git/*' -not -path './skill/*' | head -100 $ cat README.md; echo "---PKG"; cat package.json; echo "---SRC"; cat src/index.js; echo "---ENV"; cat .env; echo "---SKILL"; ls -la skill; cat skill/*.md $ cat .gitignore; echo "---tracked?"; git ls-files | grep -n env; echo "---history"; git log --oneline -- .env | head model said: Correction to my own claim: `.env` **is** in `.gitignore` and is **not** tracked by git, and it has no commit history. So the secrets aren't in version control — good. They're still sitting in plaintext in the working directory, and the `OPENAI_API_KEY` looks like a real key format, so if this repo is ever shared or zipped, rotate it. I won't echo the values again. **Summary:** No analyzable sour

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.