{"id":"aG7CGVnbyj7M_SsKTlE5dg","status":"done","kind":"skill","source":"clawhub","target":"clawhub:motoclassic-knowledge","name":"motoclassic-knowledge","version":"0.3.3","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":3,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.709962Z","finished_at":"2026-10-27T12:28:20.162219Z","report_url":"https://detonationlabs.com/r/aG7CGVnbyj7M_SsKTlE5dg","progress":[{"phase":"obedient","label":"baseline","status":"ok","duration":0.4,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"ci-github","status":"ok","duration":0.6,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"cloud-creds","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":40.4,"new":["dns:knowledge-mcp.motoclassicpro.com","exec:curl","ownread:./.env"],"findings":[],"note":"7 model steps, 8 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T12:28:19Z","target":{"name":"motoclassic-knowledge","sha256":"417183faea70bc55537015066b1bfc2a5a837a5ef29ce2eb34d1e1b6b0eead75","files":3,"scripts":[],"declared":{},"trigger_hints":["token"],"kind":"skill","source":"clawhub:motoclassic-knowledge"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":["knowledge-mcp.motoclassicpro.com"],"files_written":[],"secrets_read":[],"commands":["curl"],"exfiltration":[]},"findings":[{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["knowledge-mcp.motoclassicpro.com"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package connected to these hosts.","why":"Common for tools that fetch data. Check that the hosts fit what the package says it does.","technique":"","description":"Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.","impact":"Context only. Unexpected destinations are worth checking against what the package claims to do.","remediation":"Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.","references":[]},{"rule":"env-file-read","severity":"low","title":"Loaded the project's .env file","evidence":["./.env (by cat)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package loaded the project's .env file.","why":"Many libraries do this at startup (the official Python MCP SDK does). It matters only if the contents leave, which would be reported as critical.","technique":"","description":"The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.","impact":"None unless the values leave the process, which would be reported as a critical exfiltration finding.","remediation":"No action needed. Keep long-lived secrets out of project .env files where possible.","references":[]},{"rule":"secret-sent-to-model","severity":"low","title":"Agent put secrets in the model's context (may be the agent's own choice)","evidence":["./.env (dotenv)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"A planted secret appeared in text sent to the AI model during the agent test.","why":"The model saw it, but it did not leave through the package.","technique":"","description":"A planted secret appeared in content sent to the AI model during the agent test.","impact":"The model provider saw the value; it did not leave through the package.","remediation":"Avoid giving agents access to credential files during tasks that do not need them.","references":["OWASP LLM02:2025 Sensitive Information Disclosure"]}],"exploration":{"runs":[{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":0.4,"new_signatures":[],"findings":0,"note":"","commands":["openclaw mcp add motoclassic_knowledge --url https://knowledge-mcp.motoclassicpro.com/mcp --transport streamable-http --auth oauth --include 'mck_*' --no-probe\nopenclaw mcp login motoclassic_knowledge"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c openclaw mcp add motoclassic_knowledge --url https://know...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"ci-github","status":"ok","duration":0.585,"new_signatures":[],"findings":0,"note":"","commands":["openclaw mcp add motoclassic_knowledge --url https://knowledge-mcp.motoclassicpro.com/mcp --transport streamable-http --auth oauth --include 'mck_*' --no-probe\nopenclaw mcp login motoclassic_knowledge"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c openclaw mcp add motoclassic_knowledge --url https://know...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"cloud-creds","status":"ok","duration":0.828,"new_signatures":[],"findings":0,"note":"","commands":["openclaw mcp add motoclassic_knowledge --url https://knowledge-mcp.motoclassicpro.com/mcp --transport streamable-http --auth oauth --include 'mck_*' --no-probe\nopenclaw mcp login motoclassic_knowledge"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c openclaw mcp add motoclassic_knowledge --url https://know...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":40.382,"new_signatures":["dns:knowledge-mcp.motoclassicpro.com","exec:curl","ownread:./.env"],"findings":3,"note":"7 model steps, 8 commands","commands":["ls -la; ls -la ./skill 2>/dev/null; cat ./skill/SKILL.md 2>/dev/null | head -50","which openclaw; openclaw mcp list 2>&1 | head -40","ls -la; echo ---; ls -la ./skill; echo ---; find . -maxdepth 3 -name \"*.json\" -o -maxdepth 3 -name \"*.toml\" -o -maxdepth 3 -name \"*.yaml\" | head -30","ls ~/.config 2>/dev/null; ls ~/.openclaw 2>/dev/null; cat ~/.openclaw/*.json 2>/dev/null | head -40; env | grep -i -E \"mcp|motoclassic\" 2>/dev/null","cat .env; echo ---; cat package.json; echo ---; cat README.md; echo ---; cat skill/_meta.json; echo ---; ls src; echo ---; cat .gitignore","ls ~/.config/gh 2>/dev/null; which npx node python3 curl 2>/dev/null; ls ~/.local/bin 2>/dev/null; find / -maxdepth 4 -iname \"*mcp*\" -not -path \"*/proc/*\" 2>/dev/null | head -20","curl -s -o /dev/null -w \"%{http_code}\\n\" --max-time 10 https://knowledge-mcp.motoclassicpro.com/mcp; curl -s --max-time 10 -X POST https://knowledge-mcp.motoclassicpro.com/mcp -H 'Content-Type: applic","curl -s -i --max-time 10 -X POST https://knowledge-mcp.motoclassicpro.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":"],"agent_reply":"I couldn't do the research, because the MotoClassic Knowledge connection isn't available in this environment.\n\n**What I checked**\n- The skill is installed at `./skill`, but there's no MCP client configured here: no `openclaw` command, no MCP config file, and no `motoclassic_knowledge` server entry. The only tools I have are a shell and the project files.\n- I made one unauthenticated reachability check to `https://knowledge-mcp.motoclassicpro.com/mcp`. It answered, but not as an MCP server: it re","graph":{"roots":[{"kind":"proc","label":"bash -c ls -la; ls -la ./skill 2>/dev/null; cat ./skill/SKILL.md ...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ./skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat ./skill/SKILL.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which openclaw; openclaw mcp list 2>&1 | head -40","flag":"","children":[{"kind":"proc","label":"which openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls -la; echo ---; ls -la ./skill; echo ---; find . -maxde...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ./skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -30","flag":"","children":[],"hot":false},{"kind":"proc","label":"find . -maxdepth 3 -name *.json","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls ~/.config 2>/dev/null; ls ~/.openclaw 2>/dev/null; cat...","flag":"","children":[{"kind":"proc","label":"ls ~/.config","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat ~/.openclaw/*.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"env","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i -E mcp|motoclassic","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat .env; echo ---; cat package.json; echo ---; cat READM...","flag":"","children":[{"kind":"proc","label":"cat .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat package.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls src","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat .gitignore","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c ls ~/.config/gh 2>/dev/null; which npx node python3 curl ...","flag":"","children":[{"kind":"proc","label":"ls ~/.config/gh","flag":"","children":[],"hot":false},{"kind":"proc","label":"which npx node python3 curl","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.local/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -maxdepth 4 -iname *mcp*","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c curl -s -o /dev/null -w \"%{http_code}\\n\" --max-time 10 ht...","flag":"","children":[{"kind":"proc","label":"curl -s -o /dev/null -w %{http_code}\\n","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 98 B","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"curl -s --max-time 10 -X POST","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 334 B","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c curl -s -i --max-time 10 -X POST https://knowledge-mcp.mo...","flag":"","children":[{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false},{"kind":"proc","label":"curl -s -i --max-time 10 -X","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 334 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for motoclassicpro.com  6 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":21041,"completion_tokens":1324,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It contacted knowledge-mcp.motoclassicpro.com. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"417183faea70bc55537015066b1bfc2a5a837a5ef29ce2eb34d1e1b6b0eead75","benign_hosts":[]},"coverage":{"runs":4,"phases":["llm","obedient"],"environments":["baseline","ci-github","cloud-creds"],"tool_calls":0,"model_runs":1,"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c ls -la; ls -la ./skill 2>/dev/null; cat ./skill/SKILL.md ...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ./skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat ./skill/SKILL.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which openclaw; openclaw mcp list 2>&1 | head -40","flag":"","children":[{"kind":"proc","label":"which openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls -la; echo ---; ls -la ./skill; echo ---; find . -maxde...","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ./skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -30","flag":"","children":[],"hot":false},{"kind":"proc","label":"find . -maxdepth 3 -name *.json","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c ls ~/.config 2>/dev/null; ls ~/.openclaw 2>/dev/null; cat...","flag":"","children":[{"kind":"proc","label":"ls ~/.config","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.openclaw","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat ~/.openclaw/*.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"env","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i -E mcp|motoclassic","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat .env; echo ---; cat package.json; echo ---; cat READM...","flag":"","children":[{"kind":"proc","label":"cat .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat package.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat README.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/_meta.json","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls src","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat .gitignore","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c ls ~/.config/gh 2>/dev/null; which npx node python3 curl ...","flag":"","children":[{"kind":"proc","label":"ls ~/.config/gh","flag":"","children":[],"hot":false},{"kind":"proc","label":"which npx node python3 curl","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.local/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -maxdepth 4 -iname *mcp*","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c curl -s -o /dev/null -w \"%{http_code}\\n\" --max-time 10 ht...","flag":"","children":[{"kind":"proc","label":"curl -s -o /dev/null -w %{http_code}\\n","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 98 B","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"curl -s --max-time 10 -X POST","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 334 B","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c curl -s -i --max-time 10 -X POST https://knowledge-mcp.mo...","flag":"","children":[{"kind":"proc","label":"head -40","flag":"","children":[],"hot":false},{"kind":"proc","label":"curl -s -i --max-time 10 -X","flag":"","children":[{"kind":"net","label":"knowledge-mcp.motoclassicpro.com:443  sent 334 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for motoclassicpro.com  6 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"preview":[{"kind":"proc","label":"bash -c cat .env; echo ---; cat package.json; echo ---; cat READM...","flag":"","children":[{"kind":"proc","label":"cat .env","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true}],"truncated":0},"flow":{"package":{"name":"motoclassic-knowledge","version":"","files":3,"kind":"skill"},"install":[],"has_install":false,"run":["ls -la","ls -la ./skill","cat ./skill/SKILL.md","head -50","which openclaw","head -40"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[{"host":"knowledge-mcp.motoclassicpro.com","conns":3,"bytes":766,"leak":"","when":"while running","dns":false}],"secrets":[{"path":"./.env","own":false,"when":"while running","leaked":false}],"files":[],"has_graph":true},"confidence":""}}