{"id":"KIpDudtuvdhMRgJIJ7j3DA","status":"done","kind":"skill","source":"clawhub","target":"clawhub:dutis","name":"dutis","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.650702Z","finished_at":"2026-10-27T12:04:42.831039Z","report_url":"https://detonationlabs.com/r/KIpDudtuvdhMRgJIJ7j3DA","progress":[{"phase":"llm","label":"baseline","status":"ok","duration":30.2,"new":[],"findings":[],"note":"5 model steps, 4 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T12:04:42Z","target":{"name":"dutis","sha256":"b5dcb431c00ff78752428061e87e719ce8d2b8205bf692dc28c60a67be66634c","files":3,"scripts":[],"declared":{},"trigger_hints":["secret","token"],"kind":"skill","source":"clawhub:dutis"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":30.174,"new_signatures":[],"findings":0,"note":"5 model steps, 4 commands","commands":["cd . && ls skill && which dutis; dutis doctor --json 2>&1 | head -50","cd . && cat skill/_meta.json skill/skill-card.md; ls -la; ls /usr/local/bin /opt/homebrew/bin 2>/dev/null | head -50","cd . && cat README.md package.json .gitignore; ls src; uname -a; cat /etc/os-release 2>/dev/null | head -3","cd . && ls ~/.local/bin /opt 2>/dev/null; find / -maxdepth 4 -name 'dutis*' -not -path '*/proc/*' 2>/dev/null | head; sw_vers 2>&1 | head -2"],"agent_reply":"I couldn't run the Dutis workflow, because this environment can't support it.\n\n**What I found**\n- The skill is installed at `./skill` (Dutis v1.0.0, publisher tsonglew), but the `dutis` CLI is not installed (`dutis: command not found`), and no `dutis*` binary exists anywhere on the system.\n- This machine is **Ubuntu 24.04 Linux (x86_64)**, not macOS. Dutis manages macOS Launch Services associations (extensions, UTIs, MIME types, URL schemes), so even with the binary installed there would be no L","graph":{"roots":[{"kind":"proc","label":"bash -c cd . && ls skill && which dutis; dutis doctor --json 2>&1...","flag":"","children":[{"kind":"proc","label":"ls skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"which dutis","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && cat skill/_meta.json skill/skill-card.md; ls -la;...","flag":"","children":[{"kind":"proc","label":"cat skill/_meta.json skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /opt/homebrew/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && cat README.md package.json .gitignore; ls src; un...","flag":"","children":[{"kind":"proc","label":"cat README.md package.json .gitignore","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls src","flag":"","children":[],"hot":false},{"kind":"proc","label":"uname -a","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat /etc/os-release","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -3","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && ls ~/.local/bin /opt 2>/dev/null; find / -maxdept...","flag":"","children":[{"kind":"proc","label":"ls ~/.local/bin /opt","flag":"","children":[],"hot":false},{"kind":"proc","label":"head","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -maxdepth 4 -name dutis*","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"llm: variants exhausted","model_usage":{"prompt_tokens":11882,"completion_tokens":673,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"b5dcb431c00ff78752428061e87e719ce8d2b8205bf692dc28c60a67be66634c","benign_hosts":[]},"coverage":{"runs":1,"phases":["llm"],"environments":["baseline"],"tool_calls":0,"model_runs":1,"stopped":"llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c cd . && ls skill && which dutis; dutis doctor --json 2>&1...","flag":"","children":[{"kind":"proc","label":"ls skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"which dutis","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && cat skill/_meta.json skill/skill-card.md; ls -la;...","flag":"","children":[{"kind":"proc","label":"cat skill/_meta.json skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /opt/homebrew/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && cat README.md package.json .gitignore; ls src; un...","flag":"","children":[{"kind":"proc","label":"cat README.md package.json .gitignore","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls src","flag":"","children":[],"hot":false},{"kind":"proc","label":"uname -a","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat /etc/os-release","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -3","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd . && ls ~/.local/bin /opt 2>/dev/null; find / -maxdept...","flag":"","children":[{"kind":"proc","label":"ls ~/.local/bin /opt","flag":"","children":[],"hot":false},{"kind":"proc","label":"head","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -maxdepth 4 -name dutis*","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"dutis","version":"","files":3,"kind":"skill"},"install":[],"has_install":false,"run":["ls skill","which dutis","head -50","cat skill/_meta.json skill/skill-card.md","ls -la","ls /usr/local/bin /opt/homebrew/bin"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[],"secrets":[],"files":[],"has_graph":true},"confidence":""}}