{"id":"Yq3nz5Juirjp9DEigqDx_w","status":"done","kind":"skill","source":"clawhub","target":"clawhub:cgartlab-search","name":"cgartlab-search","version":"0.1.1","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.535414Z","finished_at":"2026-10-26T19:28:33.302826Z","report_url":"https://detonationlabs.com/r/Yq3nz5Juirjp9DEigqDx_w","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":6.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:BRAVE_SEARCH_API_KEY,EXA_API_KEY,PYTHON,TENCENT_NEWS_CLI_PATH…","status":"ok","duration":5.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"ci-github","status":"ok","duration":5.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:BRAVE_SEARCH_API_KEY,CONTEXT7_API_KEY,EXA_API_KEY,TENCENT_NEWS_KEY…","status":"ok","duration":0.7,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:BRAVE_SEARCH_API_KEY,EXA_API_KEY,PYTHON,TENCENT_NEWS_CLI_PATH…","status":"ok","duration":1.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:BRAVE_SEARCH_API_KEY,CONTEXT7_API_KEY,EXA_API_KEY,TENCENT_NEWS_KEY…","status":"ok","duration":0.6,"new":[],"findings":[],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T19:28:33Z","target":{"name":"cgartlab-search","sha256":"fff177e4ec8e28ae560f404c944d80d1f28cfd4096c8a94659ead99767b5ce6d","files":17,"scripts":["scripts/gate.sh","scripts/search.mjs","scripts/search.sh"],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:cgartlab-search"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":[],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/gate.sh","label":"baseline","status":"ok","duration":6.513,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/gate.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/gate.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c print(1)","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --check scripts/search.mjs","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n scripts/search.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import json,sys;json.load(sys.stdin)","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"python3 -c \nimport re,sys\nt=open(\"SKILL.md\",encoding=\"utf-8\").read()...","flag":"","children":[],"hot":false},{"kind":"proc","label":"git ls-files --error-unmatch secrets.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c \nimport json,sys\nd=json.load(open(\"secrets.example.json\",...","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import yaml","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/gate.sh","label":"guided:BRAVE_SEARCH_API_KEY,EXA_API_KEY,PYTHON,TENCENT_NEWS_CLI_PATH…","status":"ok","duration":5.459,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/gate.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/gate.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c print(1)","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --check scripts/search.mjs","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n scripts/search.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import json,sys;json.load(sys.stdin)","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"python3 -c \nimport re,sys\nt=open(\"SKILL.md\",encoding=\"utf-8\").read()...","flag":"","children":[],"hot":false},{"kind":"proc","label":"git ls-files --error-unmatch secrets.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c \nimport json,sys\nd=json.load(open(\"secrets.example.json\",...","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import yaml","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/gate.sh","label":"ci-github","status":"ok","duration":5.515,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/gate.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/gate.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c print(1)","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --check scripts/search.mjs","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n scripts/search.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import json,sys;json.load(sys.stdin)","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"python3 -c \nimport re,sys\nt=open(\"SKILL.md\",encoding=\"utf-8\").read()...","flag":"","children":[],"hot":false},{"kind":"proc","label":"git ls-files --error-unmatch secrets.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c \nimport json,sys\nd=json.load(open(\"secrets.example.json\",...","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import yaml","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/search.mjs","label":"baseline","status":"ok","duration":0.781,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/search.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/search.mjs","label":"guided:BRAVE_SEARCH_API_KEY,CONTEXT7_API_KEY,EXA_API_KEY,TENCENT_NEWS_KEY…","status":"ok","duration":0.706,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/search.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/search.mjs","label":"guided:BRAVE_SEARCH_API_KEY,EXA_API_KEY,PYTHON,TENCENT_NEWS_CLI_PATH…","status":"ok","duration":1.142,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/search.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/search.sh","label":"baseline","status":"ok","duration":0.423,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/search.sh","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/search.sh","label":"guided:BRAVE_SEARCH_API_KEY,CONTEXT7_API_KEY,EXA_API_KEY,TENCENT_NEWS_KEY…","status":"ok","duration":0.574,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash <skill>/scripts/search.sh","flag":"","children":[],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/gate.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/search.mjs: coverage plateau (2 runs with no new behavior); scripts/scripts/search.sh: run budget spent; llm: run budget spent","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 8 times, with a normal setup, BRAVE_SEARCH_API_KEY and EXA_API_KEY and PYTHON and TENCENT_NEWS_CLI_PATH… set, a GitHub Actions environment and BRAVE_SEARCH_API_KEY and CONTEXT7_API_KEY and EXA_API_KEY and TENCENT_NEWS_KEY… set. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"fff177e4ec8e28ae560f404c944d80d1f28cfd4096c8a94659ead99767b5ce6d","benign_hosts":[]},"coverage":{"runs":8,"phases":["scripts"],"environments":["baseline","guided:BRAVE_SEARCH_API_KEY,EXA_API_KEY,PYTHON,TENCENT_NEWS_CLI_PATH…","ci-github","guided:BRAVE_SEARCH_API_KEY,CONTEXT7_API_KEY,EXA_API_KEY,TENCENT_NEWS_KEY…"],"tool_calls":0,"model_runs":0,"stopped":"scripts/scripts/gate.sh: coverage plateau (2 runs with no new behavior); scripts/scripts/search.mjs: coverage plateau (2 runs with no new behavior); scripts/scripts/search.sh: run budget spent; llm: run budget spent"},"tree":{"run":"scripts:baseline","roots":[{"kind":"proc","label":"bash <skill>/scripts/gate.sh","flag":"","children":[{"kind":"proc","label":"dirname <skill>/scripts/gate.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c print(1)","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --check scripts/search.mjs","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -n scripts/search.sh","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import json,sys;json.load(sys.stdin)","flag":"","children":[],"hot":false,"count":2},{"kind":"proc","label":"python3 -c \nimport re,sys\nt=open(\"SKILL.md\",encoding=\"utf-8\").read()...","flag":"","children":[],"hot":false},{"kind":"proc","label":"git ls-files --error-unmatch secrets.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c \nimport json,sys\nd=json.load(open(\"secrets.example.json\",...","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -c import yaml","flag":"","children":[],"hot":false},{"kind":"proc","label":"python3 -","flag":"","children":[],"hot":false}],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"cgartlab-search","version":"","files":17,"kind":"skill"},"install":[],"has_install":false,"run":["bash <skill>/scripts/gate.sh","dirname <skill>/scripts/gate.sh","python3 -c print(1)","node --check scripts/search.mjs","bash -n scripts/search.sh","python3 -c import json,sys;json.load(sys.stdin)"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[],"secrets":[],"files":[],"has_graph":true},"confidence":""}}