{"id":"TdLv-0FT1yQPXwm7cZpohA","status":"done","kind":"skill","source":"clawhub","target":"clawhub:media-download","name":"media-download","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.676726Z","finished_at":"2026-10-27T12:14:06.093856Z","report_url":"https://detonationlabs.com/r/TdLv-0FT1yQPXwm7cZpohA","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":0.3,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:opt=a","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:opt=c","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":0.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:opt=a","status":"ok","duration":0.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:opt=c","status":"ok","duration":0.6,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"baseline","status":"ok","duration":1.5,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"guided:opt=a","status":"ok","duration":3.3,"new":[],"findings":[],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T12:14:05Z","target":{"name":"media-download","sha256":"f18aa3b4180e02ea82cfa22198041b173d6ffa4786db9ebee6916e73e6d390cd","files":6,"scripts":["scripts/pinterest.sh","scripts/video.sh"],"declared":{"allowed-tools":"Bash(bash:*) Bash(yt-dlp:*) Bash(gallery-dl:*) Bash(ffprobe:*) Read"},"trigger_hints":[],"kind":"skill","source":"clawhub:media-download"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/pinterest.sh","label":"baseline","status":"ok","duration":0.347,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/pinterest.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/pinterest.sh","label":"guided:opt=a","status":"ok","duration":0.361,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/pinterest.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/pinterest.sh","label":"guided:opt=c","status":"ok","duration":0.423,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/pinterest.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/video.sh","label":"baseline","status":"ok","duration":0.472,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/video.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/video.sh","label":"guided:opt=a","status":"ok","duration":0.457,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/video.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/video.sh","label":"guided:opt=c","status":"ok","duration":0.614,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/video.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":1.537,"new_signatures":[],"findings":0,"note":"","commands":["S=<this skill dir>/scripts/video.sh\nbash $S \"<url>\"                       # best quality → ./downloads/<Site>/<title> [<id>].mp4\nbash $S -q 720 \"<url>\"                # cap at 720p (smaller side, so v","P=<this skill dir>/scripts/pinterest.sh\nbash $P \"cinematic portrait moody\"                      # top 20 search results → ./downloads/pinterest/Search/<query>/\nbash $P -n 50 \"https://www.pinterest.com"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c cd skill && S=<this skill dir>/scripts/video.sh\nbash $S \"...","flag":"","children":[{"kind":"proc","label":"bash <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -q 720 <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -a <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -p <playlist or carousel>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -o ~/Downloads <url1> <url2>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c chrome <url>","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && P=<this skill dir>/scripts/pinterest.sh\nbash ...","flag":"","children":[{"kind":"proc","label":"bash cinematic portrait moody","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 50 https://www.pinterest.com/<user>/<board>/","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 1 https://pin.it/abc123","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 8 -o refs query one","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -k cookies.txt <private board>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -v <pin url>","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"guided:opt=a","status":"ok","duration":3.323,"new_signatures":[],"findings":0,"note":"","commands":["S=<this skill dir>/scripts/video.sh\nbash $S \"<url>\"                       # best quality → ./downloads/<Site>/<title> [<id>].mp4\nbash $S -q 720 \"<url>\"                # cap at 720p (smaller side, so v","P=<this skill dir>/scripts/pinterest.sh\nbash $P \"cinematic portrait moody\"                      # top 20 search results → ./downloads/pinterest/Search/<query>/\nbash $P -n 50 \"https://www.pinterest.com"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c cd skill && S=<this skill dir>/scripts/video.sh\nbash $S \"...","flag":"","children":[{"kind":"proc","label":"bash <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -q 720 <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -a <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -p <playlist or carousel>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -o ~/Downloads <url1> <url2>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c chrome <url>","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && P=<this skill dir>/scripts/pinterest.sh\nbash ...","flag":"","children":[{"kind":"proc","label":"bash cinematic portrait moody","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 50 https://www.pinterest.com/<user>/<board>/","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 1 https://pin.it/abc123","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 8 -o refs query one","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -k cookies.txt <private board>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -v <pin url>","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/pinterest.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/video.sh: coverage plateau (2 runs with no new behavior); obedient: run budget spent; llm: run budget spent","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 8 times, with a normal setup, opt=a set and opt=c set. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"f18aa3b4180e02ea82cfa22198041b173d6ffa4786db9ebee6916e73e6d390cd","benign_hosts":[]},"coverage":{"runs":8,"phases":["obedient","scripts"],"environments":["baseline","guided:opt=a","guided:opt=c"],"tool_calls":0,"model_runs":0,"stopped":"scripts/scripts/pinterest.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/video.sh: coverage plateau (2 runs with no new behavior); obedient: run budget spent; llm: run budget spent"},"tree":{"run":"obedient:baseline","roots":[{"kind":"proc","label":"bash -c cd skill && S=<this skill dir>/scripts/video.sh\nbash $S \"...","flag":"","children":[{"kind":"proc","label":"bash <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -q 720 <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -a <url>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -p <playlist or carousel>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -o ~/Downloads <url1> <url2>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c chrome <url>","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd skill && P=<this skill dir>/scripts/pinterest.sh\nbash ...","flag":"","children":[{"kind":"proc","label":"bash cinematic portrait moody","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 50 https://www.pinterest.com/<user>/<board>/","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 1 https://pin.it/abc123","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n 8 -o refs query one","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -k cookies.txt <private board>","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -v <pin url>","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"media-download","version":"","files":6,"kind":"skill"},"install":[],"has_install":false,"run":["bash <skill>/scripts/pinterest.sh","bash <skill>/scripts/video.sh","bash <url>","bash -q 720 <url>","bash -a <url>","bash -p <playlist or carousel>"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[],"secrets":[],"files":[],"has_graph":true},"confidence":""}}