Verdict

No malicious behavior observed

We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--weights 82.1 and the clock moved a year ahead. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: diet-plateau-decoder
Source: clawhub 1.0.0
SHA-256: 2f62b5bb94bf1ed9
Files: 7

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 7 runs

Package diet-plateau-decoder 7 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as python3 <skill>/scripts/plateau_decoder.pypython3 <skill>/scripts/plateau_decoder.py --weights 82.1python3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,python3 scripts/plateau_decoder.py --weights 180,179.5,180.2,... --expected-loss 1 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat skill/scripts/plateau_decoder.py | head -120; echo --...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo ---; ls -R skill | head -50
- runls -la
- runls -R skill
- runhead -50
runbash -c cat skill/scripts/plateau_decoder.py 2>/dev/null | head -...
- runhead -200
- runcat skill/scripts/plateau_decoder.py
runbash -c cat skill/scripts/plateau_decoder.py | head -120; echo --...
- runcat .env
  - secretread ./.env
- runhead -120
- runcat skill/scripts/plateau_decoder.py
- runcat README.md
- runls src
- runcat package.json
- runsed s/=.*/=<redacted>/
runbash -c cat skill/references/plateau-science.md | head -80; echo ...
- runcat skill/references/plateau-science.md
- runhead -80
- runhead -60
- runcat skill/README.md
runbash -c grep -rn -i "weight\|plateau\|scale" src README.md .gitig...
- rungrep -rn -i weight\|plateau\|scale src README.md
- runhead ×2
- rungit log --oneline
- runhead -5
- runls -a ~
runbash -c cd skill && python3 scripts/plateau_decoder.py --weights ...
- runpython3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,81.3,81.4,81... --expected-loss 0.5
runbash -c cd skill && python3 scripts/plateau_decoder.py --weights ...
- runpython3 scripts/plateau_decoder.py --weights 90.0,89.8,90.1,89.9,90.0,89.9,90.1,90.0,89.9,90.0,90.1,89... --expected-loss 0.5
- runpython3 scripts/plateau_decoder.py --weights 180,179.5,180.2,179.8,180.1,179.6,180.3,179.9,180.0,179.7... --expected-loss 1

Exploration log

7 runs

scripts:baseline ok · 1.8s

no new behavior
scripts:guided:LC_MESSAGES ok · 1.6s

no new behavior
scripts:docs:--weights 82.1 ok · 1.3s

no new behavior
obedient:baseline ok · 5.2s

no new behavior

$ expected_rate = deficit_kcal_per_day × 7 / 7700 kg/week (7700 kcal ≈ 1 kg fat; 3500 kcal ≈ 1 lb) water masks (typical magnitudes): sodium spike (restaurant/processed day) +0.3 – 1.2 kg for 1–3 $ python3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,81.3,81.4,81.2,81.3,81.1 \ --expected-loss 0.5 --unit kg python3 scripts/plateau_decoder.py --weights "180
obedient:guided:LC_MESSAGES ok · 5.2s

no new behavior

$ expected_rate = deficit_kcal_per_day × 7 / 7700 kg/week (7700 kcal ≈ 1 kg fat; 3500 kcal ≈ 1 lb) water masks (typical magnitudes): sodium spike (restaurant/processed day) +0.3 – 1.2 kg for 1–3 $ python3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,81.3,81.4,81.2,81.3,81.1 \ --expected-loss 0.5 --unit kg python3 scripts/plateau_decoder.py --weights "180
obedient:time-travel ok · 4.2s

no new behavior

$ expected_rate = deficit_kcal_per_day × 7 / 7700 kg/week (7700 kcal ≈ 1 kg fat; 3500 kcal ≈ 1 lb) water masks (typical magnitudes): sodium spike (restaurant/processed day) +0.3 – 1.2 kg for 1–3 $ python3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,81.3,81.4,81.2,81.3,81.1 \ --expected-loss 0.5 --unit kg python3 scripts/plateau_decoder.py --weights "180
llm:baseline ok · 17.1s

new behavior: ownread:./.env · 5 model steps, 7 commands

$ ls -la; echo ---; ls -R skill | head -50 $ cat skill/scripts/plateau_decoder.py 2>/dev/null | head -200 $ cat skill/scripts/plateau_decoder.py | head -120; echo ---; cat README.md; ls src; cat package.json; cat .env | sed 's/=.*/=<redacted>/' $ cat skill/references/plateau-science.md | head -80; echo ---; cat skill/README.md | head -60 $ grep -rn -i "weight\|plateau\|scale" src README.md .gitignore 2>/dev/null | head; git log --oneline | head -5; ls -a ~ 2>/dev/null | head $ cd skill && python3 scripts/plateau_decoder.py --weights 82.1,81.8,82.4,81.6,81.9,81.4,81.7,81.5,81.6,81.3,81.4,81.2,81.3,81.1 --expected-loss 0.5 --flag new-training $ cd skill && python3 scripts/plateau_decoder.py --weights 90.0,89.8,90.1,89.9,90.0,89.9,90.1,90.0,89.9,90.0,90.1,89.9,90.0,90.0,89.9,90.1,90.0,89.9,90.0,90.1,90.0 --expected-loss 0.5; echo =====; pytho model said: I ran the diet-plateau-decoder skill. One important note first: **there is no weight data in this project** — it's a `payments-api` Node service (src/index.js, package.json, .env), with no scale log, CSV, or JSON anywhere. So I couldn't decode *your* plateau. Instead I verified the skill's script works and ran it on three representative cases covering all three verdicts. **What the tool does:** t

scripts/scripts/plateau_decoder.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.