Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: rental-property-sell-or-hold
Source: clawhub 1.0.0
SHA-256: 21833ba486c8efb1
Files: 3

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 1 run

Package rental-property-sell-or-hold 3 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lafind . -maxdepth 3 -not -pathhead -100sed s/=.*/=<redacted>/ .env An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
- ./.git/index.lockwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by grep, sed)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cd . && cat README.md package.json .gitignore && echo "--...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env
runbash -c cd . && git status --short && git log --all --oneline | h...
- rungrep -rniE rent|condo|strata|property|mortgage|yield|cca --include=* -l .
  - secretread ./.env

View full process tree

runbash -c cd . && ls -la && echo "---" && find . -maxdepth 3 -not -...
- runls -la
- runfind . -maxdepth 3 -not -path
- runhead -100
runbash -c cd . && cat README.md package.json .gitignore && echo "--...
- runsed s/=.*/=<redacted>/ .env
  - secretread ./.env
- runcat README.md package.json .gitignore
- runcat src/index.js
- runcat skill/skill-card.md skill/_meta.json
- rungit log --oneline
- runhead -20
runbash -c cd . && git status --short && git log --all --oneline | h...
- rungrep -rniE rent|condo|strata|property|mortgage|yield|cca --include=* -l .
  - secretread ./.env
- rungit status --short
  - filewrote ./.git/index.lock
- rungit log --all --oneline
- runhead ×2
- rungrep -v ^./.git/

Exploration log

1 run

llm:baseline ok · 10.7s

new behavior: ownread:./.env, write:./.git/index, write:./.git/index.lock · 4 model steps, 3 commands

$ cd . && ls -la && echo "---" && find . -maxdepth 3 -not -path './.git/*' -type f | head -100 $ cd . && cat README.md package.json .gitignore && echo "--- src" && cat src/index.js && echo "--- skill card" && cat skill/skill-card.md skill/_meta.json && echo "--- env keys" && sed 's/=.*/=<redacted $ cd . && git status --short && git log --all --oneline | head && grep -rniE "rent|condo|strata|property|mortgage|yield|cca" --include=* -l . 2>/dev/null | grep -v '^./.git/' | head model said: I read the skill and checked the project. Here's where things stand. ## What I found The current directory is a **payments API** (`payments-api` v2.14.3: Express, Postgres, Stripe, a `/health` route, a `.env` with API keys). It contains **no rental-property data at all**: no purchase prices, rents, strata fees, property tax, mortgage balances, or investment figures. The only files that mention p

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.