Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, BASH_SOURCE set and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

0 findings. Scanned 27 Oct 2026 by detonator 0.5.1.

Target
shop-product-detail-copy-cn
Source
clawhub 1.0.0
SHA-256
6eafa88310122479
Files
14
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 4 runs
  1. Package shop-product-detail-copy-cn 14 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as bash <skill>/scripts/self-test.shdirname <skill>/scripts/self-test.shpython3 -dirname true An AI agent also used it 1 time.
  4. What it reached
    Network

    No connections.

    Credentials

    None of the planted fake keys were touched.

    Files written
    • ./.git/index.lockwritten
    • ./fixtures/forward-failure.mdwritten
    • ./fixtures/forward-success.mdwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

No findings. Detonator observed no malicious or suspicious behavior in the runs below.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c ls -la; ls -la skill 2>/dev/null; find . -maxdepth 3 -typ...
    • runls -la
    • runls -la skill
    • runhead -50
    • runfind . -maxdepth 3 -type f
  • runbash -c cd skill; cat README.md; cat fixtures/success.json; cat f...
    • runcat README.md
    • runcat fixtures/success.json
    • runcat fixtures/failure-missing-fields.json
    • runcat fixtures/forward-success.md
    • runcat fixtures/forward-failure.md
    • runcat scripts/self-test.sh
    • runcat manifest.yaml
    • runcat agents/openai.yaml
  • runbash -c cd skill; cat README.md; echo ----; cat fixtures/success....
    • runcat README.md
    • runcat fixtures/success.json
    • runcat fixtures/failure-missing-fields.json
    • runcat fixtures/forward-success.md
    • runcat fixtures/forward-failure.md
    • runcat scripts/self-test.sh
    • runcat ../README.md ../package.json ../src/index.js
  • runbash -c cd skill; cat README.md; echo ----; cat fixtures/success....
    • runcat README.md
    • runcat fixtures/success.json
    • runcat fixtures/failure-missing-fields.json
    • runcat fixtures/forward-success.md
    • runcat fixtures/forward-failure.md
  • runbash -c cd skill; bash scripts/self-test.sh; git -C .. log --onel...
    • runbash scripts/self-test.sh
      • rundirname scripts/self-test.sh
      • runpython3 -
    • runhead -5
    • rungit -C .. log --oneline
    • rungit -C .. status --short
      • filewrote ./.git/index.lock
  • runbash -c cd skill; cat > fixtures/forward-success.md <<'EOF' # 云...
    • filewrote ./fixtures/forward-success.md
    • filewrote ./fixtures/forward-failure.md
    • runcat ×2
    • runbash scripts/self-test.sh
      • rundirname scripts/self-test.sh
      • runpython3 -

Exploration log

4 runs
  1. scripts:baseline ok · 1.6s

    no new behavior

  2. scripts:guided:BASH_SOURCE ok · 0.8s

    no new behavior

  3. scripts:ci-github ok · 2.0s

    no new behavior

  4. llm:baseline ok · 22.5s

    new behavior: write:./.git/index, write:./.git/index.lock, write:./fixtures/forward-failure.md, write:./fixtures/forward-success.md · 7 model steps, 6 commands

    $ ls -la; ls -la skill 2>/dev/null; find . -maxdepth 3 -type f | head -50 $ cd skill; cat README.md; cat fixtures/success.json; cat fixtures/failure-missing-fields.json; cat fixtures/forward-success.md; cat fixtures/forward-failure.md; cat scripts/self-test.sh; cat manifest.y $ cd skill; cat README.md; echo ----; cat fixtures/success.json; echo ----; cat fixtures/failure-missing-fields.json; echo ----; cat fixtures/forward-success.md; echo ----; cat fixtures/forward-failure. $ cd skill; cat README.md; echo ----; cat fixtures/success.json; echo ----; cat fixtures/failure-missing-fields.json; echo ----; cat fixtures/forward-success.md; echo ----; cat fixtures/forward-failure. $ cd skill; bash scripts/self-test.sh; git -C .. log --oneline | head -5; git -C .. status --short $ cd skill; cat > fixtures/forward-success.md <<'EOF' # 云岚手冲咖啡滤杯｜详情页文案 ## 模块 1：首屏价值主张 1–2杯手冲，选一只规格清楚的玻璃滤杯。 面向在家练习手冲咖啡的初学者；清洁方法和耐温范围请按商家说明确认。 ## 模块 2：核心卖点与证据 ### 卖点 1：高硼硅玻璃材质 选器具先看清材质，商品资料注明为高硼硅玻璃。 model said: 我按这个 skill 的流程处理了当前项目，但**你还没有提供商品资料**，所以现在不能直接写详情页。按 SKILL.md 的规定，缺少必填字段时，应先请你补充资料，不能自行编造。 **缺少的必填字段（4 项全部缺失）：** | 字段 | 需要你提供的内容 | | --- | --- | | `product_name` | 商家确认的商品名称 | | `specifications` | 商家原始规格，例如材质、尺寸、容量、颜色、包装清单等 | | `image_notes` | 每张商品图真实展示的内容与可见细节，按图片 1、图片 2……逐条列出 | | `target_audience` | 目标客群及使用场景 | **可选字段：** `known_facts`（可被现有资料支持的事实）、`suggestions`（希望强调的表达方向，会标注为“建议”）。 请按下面的格式回复

scripts/scripts/self-test.sh: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.