Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target
dadao-investing
Source
clawhub 1.0.1
SHA-256
9287548cd0ffd0e3
Files
5
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs
  1. Package dadao-investing 5 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as ls -lals -R ./skillhead -50cat README.md package.json An AI agent also used it 1 time.
  4. What it reached
    Network

    No connections.

    Credentials
    • ./.envread
    Files written

    Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence
Info The package loaded the project's .env file.
Observed in
llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

  • runbash -c cat skill/_meta.json skill/skill-card.md; echo ---; cat s...
    • runcat .env
      • secretread ./.env
View full process tree
  • runbash -c ls -la; echo ---; ls -R ./skill | head -50
    • runls -la
    • runls -R ./skill
    • runhead -50
  • runbash -c cd /home/user 2>/dev/null; cat README.md package.json; ls...
    • runcat README.md package.json
    • runls src
    • runcat skill/references/cases-and-facts.md
    • runcat skill/references/philosophy-details.md
  • runbash -c cat skill/_meta.json skill/skill-card.md; echo ---; cat s...
    • runcat .env
      • secretread ./.env
    • runcat skill/_meta.json skill/skill-card.md
    • runhead -40
    • runcat src/index.js
    • runsed s/=.*/=<redacted>/

Exploration log

4 runs
  1. obedient:baseline ok · 0.7s

    no new behavior

    $ 【不为清单】不做空/不借钱/懂不懂 —— 逐项给出结论 【好生意】护城河与差异化是什么？现金流质量如何？ 【好人】企业文化关键词？管理层现金流分配是否理性？ 【好价格】当前价相对内在价值（定性）贵还是便宜？给出依据 【五年测试】关门五年还愿意持有吗？为什么？ 【结论】买 / 不买 / 观察 —— 一句话理由+段永平原话引用
  2. obedient:ci-github ok · 0.5s

    no new behavior

    $ 【不为清单】不做空/不借钱/懂不懂 —— 逐项给出结论 【好生意】护城河与差异化是什么？现金流质量如何？ 【好人】企业文化关键词？管理层现金流分配是否理性？ 【好价格】当前价相对内在价值（定性）贵还是便宜？给出依据 【五年测试】关门五年还愿意持有吗？为什么？ 【结论】买 / 不买 / 观察 —— 一句话理由+段永平原话引用
  3. obedient:cloud-creds ok · 0.8s

    no new behavior

    $ 【不为清单】不做空/不借钱/懂不懂 —— 逐项给出结论 【好生意】护城河与差异化是什么？现金流质量如何？ 【好人】企业文化关键词？管理层现金流分配是否理性？ 【好价格】当前价相对内在价值（定性）贵还是便宜？给出依据 【五年测试】关门五年还愿意持有吗？为什么？ 【结论】买 / 不买 / 观察 —— 一句话理由+段永平原话引用
  4. llm:baseline ok · 8.5s

    new behavior: ownread:./.env · 4 model steps, 3 commands

    $ ls -la; echo ---; ls -R ./skill | head -50 $ cd /home/user 2>/dev/null; cat README.md package.json; ls src; echo ---; cat skill/references/cases-and-facts.md; echo ---; cat skill/references/philosophy-details.md $ cat skill/_meta.json skill/skill-card.md; echo ---; cat src/index.js | head -40; cat .env | sed 's/=.*/=<redacted>/' model said: 我按 skill 的流程执行了，但**这次没法给出个股分析**——因为你的消息里没有指定要分析的公司，也没有给出具体的投资决策。skill 的流程是“先过不为清单 → 三层过滤 → 五年测试”，而这三步都必须针对一家具体公司才能进行。我不会凭空编造一家公司来演示，因为那会违反 skill 的纪律：“不编造原话、数字以已核验事实卡为准”。 **当前目录情况**：这是一个 `payments-api` 支付服务项目（Express + pg + stripe），与投资分析无关；skill 文件位于 `./skill/`，我已读取 `SKILL.md` 和两个 references 文件，框架和已核验事实卡都已准备好。 **请补充以下任一信息，我就能立刻按模板输出：** 1. 公司名称或代码（如“苹果 AAPL”“茅台 600519”“腾讯 00700”），并说明你想问的是“能不能买”“该不

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.