Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 27 Oct 2026 by detonator 0.5.1.

Target: mobile-eu-compliance
Source: clawhub 1.0.1
SHA-256: e717cd09d6f00564
Files: 7

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 1 run

Package mobile-eu-compliance 7 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lahead -100find . -maxdepth 2 -not -pathls -la ./skill An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by sed)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env

View full process tree

runbash -c pwd && ls -la && echo "---" && find . -maxdepth 2 -not -p...
- runls -la
- runhead -100
- runfind . -maxdepth 2 -not -path
runbash -c ls -la ./skill 2>/dev/null && echo "--- refs ---" && ls -...
- runls -la ./skill
- runls -la ./skill/references
- runls -la ./skill/docs
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env
- runcat README.md
- runcat package.json
- runcat .gitignore
- runcat src/index.js
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runcat skill/references/cra.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runwc -l skill/references/cra.md skill/references/evidence-templates.md skill/references/gdpr.md skill/references/red-en18031.md
- runhead -40 skill/references/cra.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runcat skill/references/red-en18031.md
- runcat skill/references/gdpr.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 40,124p skill/references/cra.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 1,45p skill/references/red-en18031.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 45,91p skill/references/red-en18031.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 1,40p skill/references/gdpr.md
- runsed -n 1,60p skill/references/evidence-templates.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 60,112p skill/references/evidence-templates.md
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runsed -n 1,20p skill/references/gdpr.md
- rungit log --oneline -20
- rungit ls-files
- runfind . -not -path ./.git/* (
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runls -la package-lock.json yarn.lock pnpm-lock.yaml
- runhead ×2
- runls -la .github
- runls -la scripts
- runls -la SECURITY.md security.txt .well-known
- runfind . -not -path ./.git/* -name
- runls -d node_modules
runbash -c cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b77...
- runcat -n src/index.js
- rungrep -rniE stripe|pg|openai|helmet|tls|https|auth|token|log|consent|... --include=*.js --include=*.json --include=*.md
- runhead -40

Exploration log

1 run

llm:baseline ok · 29.4s

new behavior: ownread:./.env · token budget reached

$ pwd && ls -la && echo "---" && find . -maxdepth 2 -not -path '*/.git/*' -not -path '*/node_modules/*' | head -100 $ ls -la ./skill 2>/dev/null && echo "--- refs ---" && ls -la ./skill/references 2>/dev/null && ls -la ./skill/docs 2>/dev/null $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && echo "=== README ===" && cat README.md && echo "=== package.json ===" && cat package.json && echo "=== .gitignore ===" && cat .gitig $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && cat skill/references/cra.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && wc -l skill/references/*.md && echo "=== cra.md head ===" && head -40 skill/references/cra.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && cat skill/references/red-en18031.md && echo "===== GDPR =====" && cat skill/references/gdpr.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && sed -n '40,124p' skill/references/cra.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && sed -n '1,45p' skill/references/red-en18031.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && sed -n '45,91p' skill/references/red-en18031.md $ cd /var/tmp/detonator-runs/f7dbee042f674ead91e4a347e50b7709/work && sed -n '1,40p' skill/references/gdpr.md && echo "=== EVIDENCE TEMPLATES ===" && sed -n '1,60p' skill/references/evidence-templates.m model said: I've read the full skill and references. Now let me verify the actual state of the codebase against the skill's inventory steps (lock files, CI, security docs, endpoints, data handling).

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.