Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: taplio-linkedin-repurposer
Source: clawhub 1.0.0
SHA-256: d8229640c6cf7333
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs

Package linkedin-repurposer 3 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lals -la skillcat ~/.claude.jsonhead -50 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat skill/_meta.json; echo "---"; cat README.md; echo "--...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; ls -la skill 2>/dev/null; echo "---";...
- runls -la
- runls -la skill
- runcat ~/.claude.json
- runhead -50
- runls ~/.claude
- runcat ~/.claude/settings.json
- runcat .mcp.json
runbash -c cat skill/_meta.json; echo "---"; cat README.md; echo "--...
- runcat .env
  - secretread ./.env
- runcat skill/_meta.json
- runcat README.md
- runcat package.json
- runls src
- runsed s/=.*/=<redacted>/

Exploration log

4 runs

obedient:baseline ok · 0.6s

no new behavior

$ SOURCE TAKEAWAY [one-line summary of the core insight] LINKEDIN POST [hook line 1] [hook line 2] [body, reformatted, 80-200 words] [CTA] WHAT I CHANGED - [bullet on the angle picked] - [bullet on what
obedient:ci-github ok · 0.7s

no new behavior

$ SOURCE TAKEAWAY [one-line summary of the core insight] LINKEDIN POST [hook line 1] [hook line 2] [body, reformatted, 80-200 words] [CTA] WHAT I CHANGED - [bullet on the angle picked] - [bullet on what
obedient:cloud-creds ok · 0.8s

no new behavior

$ SOURCE TAKEAWAY [one-line summary of the core insight] LINKEDIN POST [hook line 1] [hook line 2] [body, reformatted, 80-200 words] [CTA] WHAT I CHANGED - [bullet on the angle picked] - [bullet on what
llm:baseline ok · 7.5s

new behavior: ownread:./.env · 3 model steps, 2 commands

$ ls -la; echo "---"; ls -la skill 2>/dev/null; echo "---"; cat ~/.claude.json 2>/dev/null | head -50; echo "---"; ls ~/.claude 2>/dev/null; cat ~/.claude/settings.json 2>/dev/null; cat .mcp.json 2>/dev $ cat skill/_meta.json; echo "---"; cat README.md; echo "---"; cat package.json; echo "---"; ls src; echo "---"; cat .env | sed 's/=.*/=<redacted>/' model said: I stopped before doing anything else, because the skill's first required step is a `get_me` call to the Taplio MCP — and that MCP is not connected in this environment. There are no Taplio tools available to me, so per the skill's rules I can't ask questions or produce a post. **This skill only works with the Taplio MCP connected.** It needs it to read your `ai_settings` (industry, role, language,

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.