{"id":"IjOXWbcTIL_pNRBZNe3Mpw","status":"done","kind":"skill","source":"clawhub","target":"clawhub:gtrk-matrix","name":"gtrk-matrix","version":"1.3.9","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":2,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.637692Z","finished_at":"2026-10-27T11:55:02.461001Z","report_url":"https://detonationlabs.com/r/IjOXWbcTIL_pNRBZNe3Mpw","progress":[{"phase":"obedient","label":"baseline","status":"ok","duration":1.5,"new":["write:./is_copyright:"],"findings":[],"note":""},{"phase":"obedient","label":"declared-env","status":"ok","duration":1.6,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"ci-github","status":"ok","duration":1.7,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":9.8,"new":["ownread:./.env","ownread:~/.npmrc"],"findings":[],"note":"token budget reached"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T11:55:02Z","target":{"name":"gtrk-matrix","sha256":"fc404a837b6c9100acdcf669e5147aed3e92a1dd23bbeed1b5a30ee7dfffdbea","files":3,"scripts":[],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:gtrk-matrix"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":["./is_copyright:"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[{"rule":"env-file-read","severity":"low","title":"Loaded the project's .env file","evidence":["./.env (by sed)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package loaded the project's .env file.","why":"Many libraries do this at startup (the official Python MCP SDK does). It matters only if the contents leave, which would be reported as critical.","technique":"","description":"The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.","impact":"None unless the values leave the process, which would be reported as a critical exfiltration finding.","remediation":"No action needed. Keep long-lived secrets out of project .env files where possible.","references":[]},{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"A tool opened its own login or config file, such as npm reading ~/.npmrc.","why":"Normal: that is how the tool works. Listed so nothing is hidden.","technique":"","description":"A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.","impact":"None in itself: this is how those tools work. Listed so the report shows every credential access.","remediation":"No action needed.","references":[]}],"exploration":{"runs":[{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":1.509,"new_signatures":["write:./is_copyright:"],"findings":0,"note":"","commands":["裁定层（你）：按题材/素材形态/文稿有无/用户偏好，选配方或自创编排\n配方层（本手册 §配方库）：原子命令的调用序列——只是起手式，可变奏可自创\n原子层（gtrk CLI）：index / search(--local/--source-window) / material / describe / matrix(plan) / lay / tool image_move\n服务层（云端）：embe","gtrk matrix describe --materials <本地视频或图片> --prepare <工程目录/visual-overview> --json\ngtrk matrix describe --materials <同一素材> --review <工程目录/visual-overview/visual-review.json> --yes --json","gtrk split <拆分稿> # ② 产派单\n gtrk matrix --project <目录> --json # ③ 检索+铺轨一步走（云端）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 0 --json # ① 只出 plan 不铺\n gtrk matrix describe --plan <目录>/split/broll-plan.json --top-k 5 --json # ② 理解 top 候选，产物注入 plan\n gtrk matrix lay -","gtrk matrix index --dirs <这一部片的绝对路径> --json\n gtrk matrix search \"<该段画面描述>\" --local --dirs <这一部片的绝对路径> --source-window <中心-r>,<中心+r> --out seg-i.json --json\n gtrk matrix lay --project <目录> --plan <你组","gtrk matrix index --dirs <素材夹> --json\n gtrk matrix describe --materials <素材路径列表> --json # 全量或抽样理解（视频按场景抽帧、图片直传）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 2 --json # 本地层\n gtrk matrix --project <目录> --column --material-class concept --json # 概念层（internal 矩阵成员口）\n gtrk matrix --project <目","> is_copyright: true → 可商用（自有 ∪ 已授权）\n> is_copyright: false → 不可商用（**不是**「没版权、可随便用」）\n>","gtrk matrix --project \"\" [--lay N] [--score-floor F] [--top-k K] [--column ] --json","gtrk patch move --project --clip --to 5.0\ngtrk patch trim --project --clip --out -1s"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 裁定层（你）：按题材/素材形态/文稿有无/...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --materials <本地视频或图片> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk split <拆分稿> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <这一部片的绝对路径> --...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <素材夹> --json\n gtrk matrix...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c > is_copyright: true → 可商用（自有 ∪ 已授æ...","flag":"","children":[{"kind":"file","label":"wrote ./is_copyright:","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --project \"\" [--lay N] [-...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk patch move --project --clip --to 5.0...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"declared-env","status":"ok","duration":1.557,"new_signatures":[],"findings":0,"note":"","commands":["裁定层（你）：按题材/素材形态/文稿有无/用户偏好，选配方或自创编排\n配方层（本手册 §配方库）：原子命令的调用序列——只是起手式，可变奏可自创\n原子层（gtrk CLI）：index / search(--local/--source-window) / material / describe / matrix(plan) / lay / tool image_move\n服务层（云端）：embe","gtrk matrix describe --materials <本地视频或图片> --prepare <工程目录/visual-overview> --json\ngtrk matrix describe --materials <同一素材> --review <工程目录/visual-overview/visual-review.json> --yes --json","gtrk split <拆分稿> # ② 产派单\n gtrk matrix --project <目录> --json # ③ 检索+铺轨一步走（云端）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 0 --json # ① 只出 plan 不铺\n gtrk matrix describe --plan <目录>/split/broll-plan.json --top-k 5 --json # ② 理解 top 候选，产物注入 plan\n gtrk matrix lay -","gtrk matrix index --dirs <这一部片的绝对路径> --json\n gtrk matrix search \"<该段画面描述>\" --local --dirs <这一部片的绝对路径> --source-window <中心-r>,<中心+r> --out seg-i.json --json\n gtrk matrix lay --project <目录> --plan <你组","gtrk matrix index --dirs <素材夹> --json\n gtrk matrix describe --materials <素材路径列表> --json # 全量或抽样理解（视频按场景抽帧、图片直传）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 2 --json # 本地层\n gtrk matrix --project <目录> --column --material-class concept --json # 概念层（internal 矩阵成员口）\n gtrk matrix --project <目","> is_copyright: true → 可商用（自有 ∪ 已授权）\n> is_copyright: false → 不可商用（**不是**「没版权、可随便用」）\n>","gtrk matrix --project \"\" [--lay N] [--score-floor F] [--top-k K] [--column ] --json","gtrk patch move --project --clip --to 5.0\ngtrk patch trim --project --clip --out -1s"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 裁定层（你）：按题材/素材形态/文稿有无/...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --materials <本地视频或图片> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk split <拆分稿> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <这一部片的绝对路径> --...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <素材夹> --json\n gtrk matrix...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c > is_copyright: true → 可商用（自有 ∪ 已授æ...","flag":"","children":[{"kind":"file","label":"wrote ./is_copyright:","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --project \"\" [--lay N] [-...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk patch move --project --clip --to 5.0...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"ci-github","status":"ok","duration":1.708,"new_signatures":[],"findings":0,"note":"","commands":["裁定层（你）：按题材/素材形态/文稿有无/用户偏好，选配方或自创编排\n配方层（本手册 §配方库）：原子命令的调用序列——只是起手式，可变奏可自创\n原子层（gtrk CLI）：index / search(--local/--source-window) / material / describe / matrix(plan) / lay / tool image_move\n服务层（云端）：embe","gtrk matrix describe --materials <本地视频或图片> --prepare <工程目录/visual-overview> --json\ngtrk matrix describe --materials <同一素材> --review <工程目录/visual-overview/visual-review.json> --yes --json","gtrk split <拆分稿> # ② 产派单\n gtrk matrix --project <目录> --json # ③ 检索+铺轨一步走（云端）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 0 --json # ① 只出 plan 不铺\n gtrk matrix describe --plan <目录>/split/broll-plan.json --top-k 5 --json # ② 理解 top 候选，产物注入 plan\n gtrk matrix lay -","gtrk matrix index --dirs <这一部片的绝对路径> --json\n gtrk matrix search \"<该段画面描述>\" --local --dirs <这一部片的绝对路径> --source-window <中心-r>,<中心+r> --out seg-i.json --json\n gtrk matrix lay --project <目录> --plan <你组","gtrk matrix index --dirs <素材夹> --json\n gtrk matrix describe --materials <素材路径列表> --json # 全量或抽样理解（视频按场景抽帧、图片直传）","gtrk matrix --local --dirs <素材夹> --project <目录> --lay 2 --json # 本地层\n gtrk matrix --project <目录> --column --material-class concept --json # 概念层（internal 矩阵成员口）\n gtrk matrix --project <目","> is_copyright: true → 可商用（自有 ∪ 已授权）\n> is_copyright: false → 不可商用（**不是**「没版权、可随便用」）\n>","gtrk matrix --project \"\" [--lay N] [--score-floor F] [--top-k K] [--column ] --json","gtrk patch move --project --clip --to 5.0\ngtrk patch trim --project --clip --out -1s"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 裁定层（你）：按题材/素材形态/文稿有无/...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --materials <本地视频或图片> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk split <拆分稿> ...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <这一部片的绝对路径> --...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix index --dirs <素材夹> --json\n gtrk matrix...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --local --dirs <素材夹> --project <目录>...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c > is_copyright: true → 可商用（自有 ∪ 已授æ...","flag":"","children":[{"kind":"file","label":"wrote ./is_copyright:","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix --project \"\" [--lay N] [-...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk patch move --project --clip --to 5.0...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":9.833,"new_signatures":["ownread:./.env","ownread:~/.npmrc"],"findings":2,"note":"token budget reached","commands":["pwd && ls -la","which gtrk; gtrk --version 2>&1 | head -5","cat README.md package.json .gitignore; echo \"--- ENV ---\"; sed 's/=.*/=/' .env; echo \"--- src ---\"; ls -la src skill","cat src/index.js; echo \"--- meta ---\"; cat skill/_meta.json; echo; cat skill/skill-card.md","ls -la ~/.gitruck 2>&1; echo \"---\"; ls -la ~ 2>&1 | head -20; echo \"--- node/npm ---\"; node --version; npm --version"],"agent_reply":"I'll start by looking at the project directory to understand what we're working with.","graph":{"roots":[{"kind":"proc","label":"bash -c pwd && ls -la","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which gtrk; gtrk --version 2>&1 | head -5","flag":"","children":[{"kind":"proc","label":"which gtrk","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat README.md package.json .gitignore; echo \"--- ENV ---\"...","flag":"","children":[{"kind":"proc","label":"sed s/=.*/=/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat README.md package.json .gitignore","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src skill","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c cat src/index.js; echo \"--- meta ---\"; cat skill/_meta.js...","flag":"","children":[{"kind":"proc","label":"cat src/index.js","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/skill-card.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls -la ~/.gitruck 2>&1; echo \"---\"; ls -la ~ 2>&1 | head ...","flag":"","children":[{"kind":"proc","label":"ls -la ~/.gitruck","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --version","flag":"","children":[],"hot":false},{"kind":"proc","label":"npm --version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm --version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":64147,"completion_tokens":308,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 4 times, with a normal setup, the environment variables it says it needs and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"fc404a837b6c9100acdcf669e5147aed3e92a1dd23bbeed1b5a30ee7dfffdbea","benign_hosts":[]},"coverage":{"runs":4,"phases":["llm","obedient"],"environments":["baseline","declared-env","ci-github"],"tool_calls":0,"model_runs":1,"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c pwd && ls -la","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which gtrk; gtrk --version 2>&1 | head -5","flag":"","children":[{"kind":"proc","label":"which gtrk","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -5","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat README.md package.json .gitignore; echo \"--- ENV ---\"...","flag":"","children":[{"kind":"proc","label":"sed s/=.*/=/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat README.md package.json .gitignore","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src skill","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c cat src/index.js; echo \"--- meta ---\"; cat skill/_meta.js...","flag":"","children":[{"kind":"proc","label":"cat src/index.js","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/skill-card.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls -la ~/.gitruck 2>&1; echo \"---\"; ls -la ~ 2>&1 | head ...","flag":"","children":[{"kind":"proc","label":"ls -la ~/.gitruck","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --version","flag":"","children":[],"hot":false},{"kind":"proc","label":"npm --version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm --version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"preview":[{"kind":"proc","label":"bash -c cat README.md package.json .gitignore; echo \"--- ENV ---\"...","flag":"","children":[{"kind":"proc","label":"sed s/=.*/=/ .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true}],"truncated":0},"flow":{"package":{"name":"gtrk-matrix","version":"","files":3,"kind":"skill"},"install":[],"has_install":false,"run":["ls -la","which gtrk","head -5","sed s/=.*/=/ .env","cat README.md package.json .gitignore","ls -la src skill"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[],"secrets":[{"path":"./.env","own":false,"when":"while running","leaked":false},{"path":"~/.npmrc","own":true,"when":"while running","leaked":false}],"files":[{"path":"./is_copyright:","persist":false,"when":"while running"}],"has_graph":true},"confidence":""}}