{"id":"MgSTjEFYwthZTnkZkEKaAQ","status":"done","kind":"skill","source":"clawhub","target":"clawhub:unwrap-markdown","name":"unwrap-markdown","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.561996Z","finished_at":"2026-10-26T19:37:56.629810Z","report_url":"https://detonationlabs.com/r/MgSTjEFYwthZTnkZkEKaAQ","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":0.7,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:LC_MESSAGES","status":"ok","duration":0.9,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"docs:--dry-run path/to/folder","status":"ok","duration":0.9,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"baseline","status":"ok","duration":3.6,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"guided:LC_MESSAGES","status":"ok","duration":3.4,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"ci-github","status":"ok","duration":3.1,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":9.9,"new":["write:./.git/index","write:./.git/index.lock"],"findings":[],"note":"5 model steps, 6 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T19:37:56Z","target":{"name":"unwrap-markdown","sha256":"14da7c0cf5ff04a7aac1c05d9553784e9d1c91a977731bad312c93f5971fed78","files":4,"scripts":["scripts/unwrap_md.py"],"declared":{},"trigger_hints":["CI"],"kind":"skill","source":"clawhub:unwrap-markdown"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":["./.git/index","./.git/index.lock"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/unwrap_md.py","label":"baseline","status":"ok","duration":0.748,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/unwrap_md.py","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/unwrap_md.py","label":"guided:LC_MESSAGES","status":"ok","duration":0.923,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/unwrap_md.py","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/unwrap_md.py","label":"docs:--dry-run path/to/folder","status":"ok","duration":0.852,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"python3 <skill>/scripts/unwrap_md.py --dry-run path/to/folder","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":3.569,"new_signatures":[],"findings":0,"note":"","commands":["python3 scripts/unwrap_md.py --dry-run path/to/folder","python3 scripts/unwrap_md.py path/to/file.md","python3 scripts/unwrap_md.py path/to/folder","python3 scripts/unwrap_md.py --check path/to/folder"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --dry-run path/t...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --dry-run path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --check path/to/...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --check path/to/folder","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"guided:LC_MESSAGES","status":"ok","duration":3.378,"new_signatures":[],"findings":0,"note":"","commands":["python3 scripts/unwrap_md.py --dry-run path/to/folder","python3 scripts/unwrap_md.py path/to/file.md","python3 scripts/unwrap_md.py path/to/folder","python3 scripts/unwrap_md.py --check path/to/folder"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --dry-run path/t...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --dry-run path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --check path/to/...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --check path/to/folder","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"ci-github","status":"ok","duration":3.068,"new_signatures":[],"findings":0,"note":"","commands":["python3 scripts/unwrap_md.py --dry-run path/to/folder","python3 scripts/unwrap_md.py path/to/file.md","python3 scripts/unwrap_md.py path/to/folder","python3 scripts/unwrap_md.py --check path/to/folder"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --dry-run path/t...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --dry-run path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/file.md","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py path/to/folder","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && python3 scripts/unwrap_md.py --check path/to/...","flag":"","children":[{"kind":"proc","label":"python3 scripts/unwrap_md.py --check path/to/folder","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":9.879,"new_signatures":["write:./.git/index","write:./.git/index.lock"],"findings":0,"note":"5 model steps, 6 commands","commands":["cd \"$(pwd)\" && ls -la && echo \"---\" && ls -la skill && echo \"---\" && ls -la skill/scripts 2>/dev/null","cd \"$(pwd)\" && find . -name \"*.md\" -not -path \"./skill/*\" -not -path \"*/node_modules/*\" -not -path \"*/.git/*\" | head -100","cd \"$(pwd)\" && cat README.md && echo \"=== git status ===\" && git status --short && echo \"=== log ===\" && git log --oneline -5 && echo \"=== src ===\" && ls -la src","cd \"$(pwd)\" && cat skill/scripts/unwrap_md.py","cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --dry-run . ; echo \"exit=$?\"","cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --check . ; echo \"exit=$?\"; echo \"=== README bytes ===\"; cat -A README.md"],"agent_reply":"I ran the unwrap-markdown skill on the project, and there was nothing to change.\n\n**What I found**\n- The only Markdown file outside the skill folder is `README.md`. It is already one line per paragraph: a heading, a blank line, and one prose line.\n- `skill/` is untracked and is the skill itself, so I left it alone.\n\n**What I ran**\n- `python3 skill/scripts/unwrap_md.py --dry-run .` → `0 file(s) would be updated`, exit 0.\n- `python3 skill/scripts/unwrap_md.py --check .` → no files reported, exit 0","graph":{"roots":[{"kind":"proc","label":"bash -c cd \"$(pwd)\" && ls -la && echo \"---\" && ls -la skill && ec...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill/scripts","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && find . -name \"*.md\" -not -path \"./skill/*\"...","flag":"","children":[{"kind":"proc","label":"head -100","flag":"","children":[],"hot":false},{"kind":"proc","label":"find . -name *.md -not -path","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && cat README.md && echo \"=== git status ===\"...","flag":"","children":[{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"git status --short","flag":"","children":[{"kind":"file","label":"wrote ./.git/index.lock","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"git log --oneline -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && cat skill/scripts/unwrap_md.py","flag":"","children":[{"kind":"proc","label":"cat skill/scripts/unwrap_md.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --dry-r...","flag":"","children":[{"kind":"proc","label":"python3 skill/scripts/unwrap_md.py --dry-run .","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --check...","flag":"","children":[{"kind":"proc","label":"python3 skill/scripts/unwrap_md.py --check .","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat -A README.md","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/unwrap_md.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":13661,"completion_tokens":649,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--dry-run path/to/folder and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"14da7c0cf5ff04a7aac1c05d9553784e9d1c91a977731bad312c93f5971fed78","benign_hosts":[]},"coverage":{"runs":7,"phases":["llm","obedient","scripts"],"environments":["baseline","guided:LC_MESSAGES","docs:--dry-run path/to/folder","ci-github"],"tool_calls":0,"model_runs":1,"stopped":"scripts/scripts/unwrap_md.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c cd \"$(pwd)\" && ls -la && echo \"---\" && ls -la skill && ec...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la skill/scripts","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && find . -name \"*.md\" -not -path \"./skill/*\"...","flag":"","children":[{"kind":"proc","label":"head -100","flag":"","children":[],"hot":false},{"kind":"proc","label":"find . -name *.md -not -path","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && cat README.md && echo \"=== git status ===\"...","flag":"","children":[{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"git status --short","flag":"","children":[{"kind":"file","label":"wrote ./.git/index.lock","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"git log --oneline -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la src","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && cat skill/scripts/unwrap_md.py","flag":"","children":[{"kind":"proc","label":"cat skill/scripts/unwrap_md.py","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --dry-r...","flag":"","children":[{"kind":"proc","label":"python3 skill/scripts/unwrap_md.py --dry-run .","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd \"$(pwd)\" && python3 skill/scripts/unwrap_md.py --check...","flag":"","children":[{"kind":"proc","label":"python3 skill/scripts/unwrap_md.py --check .","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat -A README.md","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"unwrap-markdown","version":"","files":4,"kind":"skill"},"install":[],"has_install":false,"run":["python3 <skill>/scripts/unwrap_md.py","python3 <skill>/scripts/unwrap_md.py --dry-run path/to/folder","python3 scripts/unwrap_md.py --dry-run path/to/folder","python3 scripts/unwrap_md.py path/to/file.md","python3 scripts/unwrap_md.py path/to/folder","python3 scripts/unwrap_md.py --check path/to/folder"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[],"secrets":[],"files":[{"path":"./.git/index.lock","persist":false,"when":"while running"}],"has_graph":true},"confidence":""}}