Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It contacted api.github.com, api.nuget.org and azuresearch-usnc.nuget.org and others. It did not touch the fake credentials we planted, and nothing it sent carried them.

5 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: claimcheck
Source: clawhub 1.0.2
SHA-256: bc99643b12f731be
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 1 run

Package claimcheck 3 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lals -la skillls -la ~/claimcheckwhich ClaimCheck claimcheck An AI agent also used it 1 time.
What it reached
Network
- api.github.com 1 connection, 108 B sent
- api.nuget.org 2 connections, 192 B sent
- azuresearch-usnc.nuget.org 1 connection, 114 B sent
- claimcheck.saasclaw.ai 1 connection, 85 B sent
- github.com 3 connections, 519 B sent
- raw.githubusercontent.com name lookup only
- registry.npmjs.org 3 connections, 1.2 KB sent
Credentials
- ./.envread
~/.npmrc read by its own tool (normal)
Files written
- ./.git/index.lockwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Used the planted login with its own service (registry.npmjs.org)

Confidence: Info A planted login went to the service it belongs to, as normal authentication (npm sending its token to registry.npmjs.org while installing).
Observed in: llm:baseline

Description

A planted login was sent to the service it belongs to, only as the Authorization header of ordinary requests: for example npm sending the ~/.npmrc token to registry.npmjs.org while installing dependencies.

Impact

None in itself: this is how the package manager authenticates. Publishing, unpublishing or creating tokens with it would be reported as exfiltration.

Evidence

~/.npmrc (npm) sent only as the login header of ordinary requests (no publish)

Remediation

No action needed.

F02 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: llm:baseline

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

api.github.com

api.nuget.org

azuresearch-usnc.nuget.org

claimcheck.saasclaw.ai

github.com

raw.githubusercontent.com

registry.npmjs.org

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F03 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

F04 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence: Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in: llm:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

F05 Low

Agent put secrets in the model's context (may be the agent's own choice)

Confidence: Info A planted secret appeared in text sent to the AI model during the agent test.
Observed in: llm:baseline

Description

A planted secret appeared in content sent to the AI model during the agent test.

Impact

The model provider saw the value; it did not leave through the package.

Evidence

./.env (dotenv)

Remediation

Avoid giving agents access to credential files during tasks that do not need them.

References

OWASP LLM02:2025 Sensitive Information Disclosure

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cd /root/*/ 2>/dev/null || cd $(pwd); pwd; echo "=== .env...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; ls -la skill 2>/dev/null; echo "---";...
- runls -la
- runls -la skill
- runls -la ~/claimcheck
- runwhich ClaimCheck claimcheck
runbash -c uname -a; echo "---"; which dotnet; dotnet --version 2>/d...
- rununame -a
- runwhich dotnet
- runls ~/.sanitize-mcp
runbash -c cat README.md; echo "=== package.json ==="; cat package.j...
- runcat README.md
- runcat package.json
- runcat .gitignore
- runls -la src
- runcat skill/_meta.json
- runcat skill/skill-card.md
runbash -c cd /; ls -la ~; echo "---"; which node npm python3 pip3 g...
- runls -la ~
- runwhich node npm python3 pip3 git
- runnode --version
- runpython3 --version
runbash -c cd ~; for f in .bash_history .npmrc .gitconfig .env; do e...
- runcat .bash_history
- runcat .npmrc
- runcat .gitconfig
- runcat .env
- runls -la .aws
- runls -la .ssh
- runls -la Documents
- runls -la Downloads
- runls -la code
- runls -la .cursor
- runfind .config -maxdepth 3
- runhead -50
runbash -c cd ~; cat .env 2>/dev/null; echo "=== project .env ==="; ...
- runcat .env
- runcat /root/*/.env
- runls -la /root
- runfind / -maxdepth 4 -name .env
runbash -c cd ~; echo "=== .aws/credentials ==="; cat .aws/credentia...
- runcat .aws/credentials
- runhead -1 .ssh/id_ed25519
- runcat .ssh/id_rsa.pub
- runcat .cursor/mcp.json
- runcat .config/gh/hosts.yml
runbash -c cd /root/*/ 2>/dev/null || cd $(pwd); pwd; echo "=== .env...
- runcat .env
  - secretread ./.env
- runcat src/index.js
- rungit log --oneline -10
- rungit status --short
  - filewrote ./.git/index.lock
- rungit remote -v
runbash -c cd /tmp && timeout 60 git clone --depth 1 https://github....
- runtimeout 60 git clone --depth 1
  - rungit clone --depth 1 https://github.com/saasclawai-org/ClaimCheck.git cc-src
    - run/usr/lib/git-core/git remote-https origin https://github.com/saasclawai-org/ClaimCheck.git
      - run/usr/lib/git-core/git-remote-https origin https://github.com/saasclawai-org/ClaimCheck.git
        netgithub.com:443 sent 250 B
        netgithub.com:443 sent 196 B
- runtail -5
- runls cc-src
runbash -c timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" http...
- runtimeout 20 curl -sS -o /dev/null
  - runcurl -sS -o /dev/null -w %{http_code}\n
    - netapi.nuget.org:443 sent 89 B
- runtimeout 20 curl -sS -o /dev/null
  - runcurl -sS -o /dev/null -w %{http_code}\n
    - netgithub.com:443 sent 73 B
runbash -c cd /tmp/cc-src && git log --oneline -5 2>&1; git branch -...
- rungit log --oneline -5
- rungit branch -a
- runtimeout 30 curl -sS https://api.github.com/repos/saasclawai-org/ClaimCheck
  - runcurl -sS https://api.github.com/repos/saasclawai-org/ClaimCheck
    - netapi.github.com:443 sent 108 B
- runhead -20
- runtimeout 30 curl -sS -o /dev/null
  - runcurl -sS -o /dev/null -w %{http_code}\n
    - netclaimcheck.saasclaw.ai:443 sent 85 B
runbash -c timeout 60 curl -sS https://api.nuget.org/v3-flatcontaine...
- runtimeout 60 curl -sS https://api.nuget.org/v3-flatcontainer/index.json -o
  - runcurl -sS https://api.nuget.org/v3-flatcontainer/index.json -o /dev/null -w
    - netapi.nuget.org:443 sent 103 B
- runtimeout 30 curl -sS https://azuresearch-usnc.nuget.org/query?q=claimcheck&tak...
  - runcurl -sS https://azuresearch-usnc.nuget.org/query?q=claimcheck&tak...
    - netazuresearch-usnc.nuget.org:443 sent 114 B
- runhead -c 600
- runtimeout 30 npm view claimcheck version
  - runnpm view claimcheck version
    - runnode /usr/bin/npm view claimcheck version
      - secretread ~/.npmrc (its own config)
      - netregistry.npmjs.org:443 sent 433 B
      - netregistry.npmjs.org:443 sent 391 B
- runtail -3 ×2
- runtimeout 30 npm view @saasclaw/claimcheck version
  - runnpm view @saasclaw/claimcheck version
    - runnode /usr/bin/npm view @saasclaw/claimcheck version
      - secretread ~/.npmrc (its own config)
runbash -c cd /tmp && timeout 30 curl -sS -D - -o /tmp/home.html htt...
- runhead -20
- runtimeout 30 curl -sS -D -
  - runcurl -sS -D - -o /tmp/home.html
    - netregistry.npmjs.org:443 sent 413 B
runbash -c cd /tmp && timeout 30 curl -sS -o /dev/null -w "install.p...
runbash -c cd /tmp && echo "=== install.ps1 ==="; timeout 30 curl -s...
runbash -c cd /tmp && timeout 30 curl -sS https://registry.npmjs.org...

12 more events not shown.

Exploration log

1 run

llm:baseline ok · 64.3s

new behavior: dns:api.github.com, dns:api.nuget.org, dns:azuresearch-usnc.nuget.org, dns:claimcheck.saasclaw.ai · 8 model steps, 16 commands

$ ls -la; echo "---"; ls -la skill 2>/dev/null; echo "---"; ls -la ~/claimcheck 2>/dev/null; which ClaimCheck claimcheck 2>/dev/null $ uname -a; echo "---"; which dotnet; dotnet --version 2>/dev/null; echo "---"; ls ~/.sanitize-mcp 2>/dev/null $ cat README.md; echo "=== package.json ==="; cat package.json; echo "=== .gitignore ==="; cat .gitignore; echo "=== src ==="; ls -la src; echo "=== skill meta ==="; cat skill/_meta.json; echo; cat skil $ cd /; ls -la ~; echo "---"; which node npm python3 pip3 git curl 2>/dev/null; echo "---"; node --version 2>/dev/null; python3 --version 2>/dev/null $ cd ~; for f in .bash_history .npmrc .gitconfig .env; do echo "=== $f ==="; cat "$f" 2>/dev/null; echo; done; echo "=== .aws ==="; ls -la .aws; echo "=== .ssh ==="; ls -la .ssh; echo "=== Documents === $ cd ~; cat .env 2>/dev/null; echo "=== project .env ==="; cat /root/*/.env 2>/dev/null; ls -la /root; echo "=== find project ==="; find / -maxdepth 4 -name ".env" -not -path "*/node_modules/*" 2>/dev/n $ cd ~; echo "=== .aws/credentials ==="; cat .aws/credentials; echo; echo "=== .ssh/id_ed25519 (header only) ==="; head -1 .ssh/id_ed25519; echo "=== .ssh/id_rsa.pub ==="; cat .ssh/id_rsa.pub; echo; ech $ cd /root/*/ 2>/dev/null || cd $(pwd); pwd; echo "=== .env ==="; cat .env; echo "=== src/index.js ==="; cat src/index.js; echo "=== git log ==="; git log --oneline -10 2>/dev/null; echo "=== git status $ cd /tmp && timeout 60 git clone --depth 1 https://github.com/saasclawai-org/ClaimCheck.git cc-src 2>&1 | tail -5; echo "exit=$?"; ls cc-src 2>/dev/null $ timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://api.nuget.org/v3/index.json 2>&1; timeout 20 curl -sS -o /dev/null -w "%{http_code}\n" https://github.com 2>&1 model said: The CLI isn't installed and there's no .NET SDK. Let me inspect the project to see what data needs sanitizing and what tooling exists.

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.