Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, BASH_SOURCE set and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

0 findings. Scanned 27 Oct 2026 by detonator 0.5.1.

Target
video-overloaded-shot-split-cn
Source
clawhub 1.0.1
SHA-256
0b63c305ef06b3a4
Files
17
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 4 runs
  1. Package video-overloaded-shot-split-cn 17 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as bash <skill>/scripts/self-test.shdirname <skill>/scripts/self-test.shgrep -q ^name: video-overloaded-shot-split-cn$ SKILL.mdgrep -q ^name: video-overloaded-shot-split-cn$ manifest.yaml An AI agent also used it 1 time.
  4. What it reached
    Network

    No connections.

    Credentials

    None of the planted fake keys were touched.

    Files written

    Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

No findings. Detonator observed no malicious or suspicious behavior in the runs below.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c ls -la; ls -R ./skill | head -50
    • runls -la
    • runls -R ./skill
    • runhead -50
  • runbash -c cd skill; cat fixtures/success-input.md; echo ----; cat f...
    • runcat fixtures/success-input.md
    • runcat fixtures/success-output.md
    • runcat fixtures/failure-input.md
    • runcat fixtures/failure-output.md
    • runcat README.md
    • runls ../src
    • runcat ../README.md
  • runbash -c cd skill; cat scripts/self-test.sh; cat manifest.yaml; ca...
    • runcat scripts/self-test.sh
    • runcat manifest.yaml
    • runcat _meta.json
    • runcat agents/openai.yaml
    • rungit -C .. log --oneline
    • runhead
  • runbash -c cd skill; bash scripts/self-test.sh
    • runbash scripts/self-test.sh
      • rundirname scripts/self-test.sh
      • rungrep -q ^name: video-overloaded-shot-split-cn$ SKILL.md
      • rungrep -q ^name: video-overloaded-shot-split-cn$ manifest.yaml
      • rungrep -q ^slug: video-overloaded-shot-split-cn$ manifest.yaml
      • rungrep -q ^icon: icon-512.png$ manifest.yaml
      • rungrep -q allow_implicit_invocation: true agents/openai.yaml
      • rungrep -q 成功样例 README.md
      • rungrep -q npx skills add xxjrq/video-overloaded-shot-split-cn README.md
      • rungrep -q 不补充存储卡的藏放位置、状态或持拿方式 fixtures/success-output.md
      • rungrep -q 不设定追兵人数、距离或装备 fixtures/success-output.md
      • rungrep -q 不补充追兵后续位置或主路环境细节 fixtures/success-output.md
      • rungrep -q ^补充模板：$ fixtures/failure-output.md
      • runpython3 -

Exploration log

4 runs
  1. scripts:baseline ok · 2.0s

    no new behavior

  2. scripts:guided:BASH_SOURCE ok · 0.5s

    no new behavior

  3. scripts:ci-github ok · 2.0s

    no new behavior

  4. llm:baseline ok · 11.7s

    no new behavior · 5 model steps, 4 commands

    $ ls -la; ls -R ./skill | head -50 $ cd skill; cat fixtures/success-input.md; echo ----; cat fixtures/success-output.md; echo ----; cat fixtures/failure-input.md; echo ----; cat fixtures/failure-output.md; echo ----; cat README.md; ls .. $ cd skill; cat scripts/self-test.sh; cat manifest.yaml; cat _meta.json; cat agents/openai.yaml; git -C .. log --oneline | head $ cd skill; bash scripts/self-test.sh model said: 我按 `video-overloaded-shot-split-cn` 的规则检查了当前项目，但**没有找到可以拆分的镜头材料**，因此没有生成镜头表，也没有改动任何文件。 ## 缺少资料 这个技能需要三项必需输入，目前三项都缺： | 必需项 | 状态 | |---|---| | 已有镜头描述 | 未提供 | | 情节必留点 | 未提供 | | 总时长预算（秒） | 未提供 | 可选补充项：画幅、镜头风格、已有素材限制（例如不能实拍、只能用生成画面）。 另外，当前目录是一个 `payments-api` 服务项目，其中没有剧本、分镜或镜头描述文件，因此无法从项目里自行提取材料。 ## 补充模板（可直接复制填写） ```text 已有镜头描述： （原文照抄，一次只提交一个章节、一个场景或一篇短文） 情节必留点： 1. 2. 3. 总时长预算：__ 秒 可选： 画幅：__

scripts/scripts/self-test.sh: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.