{"id":"kecT0YCa_0Wr1rn2DiWthA","status":"done","kind":"skill","source":"clawhub","target":"clawhub:gtrk-food-recap","name":"gtrk-food-recap","version":"1.3.9","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":4,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-27T11:18:04.641548Z","finished_at":"2026-10-27T11:59:37.234169Z","report_url":"https://detonationlabs.com/r/kecT0YCa_0Wr1rn2DiWthA","progress":[{"phase":"obedient","label":"baseline","status":"ok","duration":0.7,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"declared-env","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"obedient","label":"ci-github","status":"ok","duration":0.7,"new":[],"findings":[],"note":""},{"phase":"llm","label":"baseline","status":"ok","duration":83.4,"new":["dns:clawhub.ai","dns:github.com","dns:registry.npmjs.org","exec:curl","ownread:./.env"],"findings":[],"note":"8 model steps, 12 commands"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-27T11:59:36Z","target":{"name":"gtrk-food-recap","sha256":"bb097a00e2956d0ed4a5c78904fb538c69d85cabaa66739e072fb63fd291f0ff","files":3,"scripts":[],"declared":{},"trigger_hints":[],"kind":"skill","source":"clawhub:gtrk-food-recap"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":["clawhub.ai","github.com","registry.npmjs.org"],"files_written":["~/.npm/_cacache/content-v2/sha512/f4/96/*","~/.npm/_cacache/index-v5/2c/97/*","~/.npm/_cacache/tmp/273e43ff","~/.npm/_cacache/tmp/87f235dd","~/.npm/_cacache/tmp/998c419e","~/.npm/_cacache/tmp/c2728d03","~/.npm/_cacache/tmp/e01275b9","~/.npm/_logs/*-debug-0.log","~/.npm/_update-notifier-last-checked"],"secrets_read":["~/.bash_history","~/.npmrc"],"commands":["curl"],"exfiltration":[]},"findings":[{"rule":"secret-login-use","severity":"low","title":"Used a planted key with the service it belongs to (registry.npmjs.org)","evidence":["~/.npmrc (npm) sent only as the login header of requests to registry.npmjs.org"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"A planted key went to the service it belongs to, as its login (npm to its registry, an OpenAI key to api.openai.com).","why":"The key reached no one new, but it was used: on your machine that would spend your account. Listed so nothing is hidden.","technique":"","description":"A planted key was sent to the service it belongs to, only as the login header of its requests: npm sending the ~/.npmrc token to registry.npmjs.org while installing, or an app calling api.openai.com with the OpenAI key from .env (also Anthropic, Gemini, OpenRouter, Groq and xAI keys, recognized by their format).","impact":"Using the key spends your account (API costs), which is worth knowing, but the key did not reach anyone new. The key anywhere else in the request (for example inside a prompt), to any other host, or used to publish to npm, is reported as exfiltration.","remediation":"No action needed.","references":[]},{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["clawhub.ai","github.com","registry.npmjs.org"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package connected to these hosts.","why":"Common for tools that fetch data. Check that the hosts fit what the package says it does.","technique":"","description":"Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.","impact":"Context only. Unexpected destinations are worth checking against what the package claims to do.","remediation":"Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.","references":[]},{"rule":"env-file-read","severity":"low","title":"Loaded the project's .env file","evidence":["./.env (by cat)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"The package loaded the project's .env file.","why":"Many libraries do this at startup (the official Python MCP SDK does). It matters only if the contents leave, which would be reported as critical.","technique":"","description":"The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.","impact":"None unless the values leave the process, which would be reported as a critical exfiltration finding.","remediation":"No action needed. Keep long-lived secrets out of project .env files where possible.","references":[]},{"rule":"secret-read","severity":"low","title":"Agent read credential files (may be the agent's own choice)","evidence":["~/.bash_history (by cat)","~/.npmrc (by cat, npm)"],"run_label":"llm:baseline","confidence":"Info","confidence_reason":"A credential file was opened by a program that does not own it.","why":"Reading credentials is the first step of stealing them; we did not see them leave in this run.","technique":"T1552.001 Credentials in files","description":"A program opened a credential file that it does not own: for example a package script reading ~/.npmrc, ~/.aws/credentials or ~/.ssh/id_rsa, rather than npm, the AWS CLI or ssh reading their own files. The reading program is named in the evidence. In this run the contents were not seen leaving the sandbox.","impact":"Reading credentials is the collection step that precedes theft. Exfiltration may be gated on conditions this run did not meet (a different date, CI variables, a reachable network), or the data may be staged for a later step.","remediation":"Review why this package needs the file. Legitimate tools read only their own configuration; anything else should be treated as hostile until explained. Prefer running it with credentials unavailable (separate user, container, or scoped environment).","references":["ATT&CK T1552.001 Credentials in Files","CWE-200 Exposure of Sensitive Information","OWASP MCP01:2025 Token Mismanagement & Secret Exposure"]}],"exploration":{"runs":[{"phase":"obedient","target":"SKILL.md","label":"baseline","status":"ok","duration":0.74,"new_signatures":[],"findings":0,"note":"","commands":["判这一帧对美食短视频有没有「看点」，0-100：\n- 大分量怼脸：食物占画面主体且分量夸张（堆尖的饭、溢出碗沿的面、整条鱼）\n- 夸张数量与价格的实物：成排的锅/几十份摆盘/写着惊人价格的标牌\n- 人山排队：门口长队、满座、等位人群\n- 名场面动作：颠勺起火、切生鱼片、拉面甩水、铁板翻面\n- 反差罕见：凌晨空店、后厨全景、老器物、店主的手\n低分：空镜过渡、无主体的墙面桌面、拍糊的中间帧、纯字幕帧","gtrk matrix describe --plan <工程>/split/broll-plan.json --highlight-rubric @<工程>/highlight-rubric.txt"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 判这一帧对美食短视频有没有「看点」，0-1...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --plan <工程>/split/broll-plan.jso...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"declared-env","status":"ok","duration":0.84,"new_signatures":[],"findings":0,"note":"","commands":["判这一帧对美食短视频有没有「看点」，0-100：\n- 大分量怼脸：食物占画面主体且分量夸张（堆尖的饭、溢出碗沿的面、整条鱼）\n- 夸张数量与价格的实物：成排的锅/几十份摆盘/写着惊人价格的标牌\n- 人山排队：门口长队、满座、等位人群\n- 名场面动作：颠勺起火、切生鱼片、拉面甩水、铁板翻面\n- 反差罕见：凌晨空店、后厨全景、老器物、店主的手\n低分：空镜过渡、无主体的墙面桌面、拍糊的中间帧、纯字幕帧","gtrk matrix describe --plan <工程>/split/broll-plan.json --highlight-rubric @<工程>/highlight-rubric.txt"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 判这一帧对美食短视频有没有「看点」，0-1...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --plan <工程>/split/broll-plan.jso...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"obedient","target":"SKILL.md","label":"ci-github","status":"ok","duration":0.691,"new_signatures":[],"findings":0,"note":"","commands":["判这一帧对美食短视频有没有「看点」，0-100：\n- 大分量怼脸：食物占画面主体且分量夸张（堆尖的饭、溢出碗沿的面、整条鱼）\n- 夸张数量与价格的实物：成排的锅/几十份摆盘/写着惊人价格的标牌\n- 人山排队：门口长队、满座、等位人群\n- 名场面动作：颠勺起火、切生鱼片、拉面甩水、铁板翻面\n- 反差罕见：凌晨空店、后厨全景、老器物、店主的手\n低分：空镜过渡、无主体的墙面桌面、拍糊的中间帧、纯字幕帧","gtrk matrix describe --plan <工程>/split/broll-plan.json --highlight-rubric @<工程>/highlight-rubric.txt"],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"bash -c 判这一帧对美食短视频有没有「看点」，0-1...","flag":"","children":[],"hot":false},{"kind":"proc","label":"bash -c gtrk matrix describe --plan <工程>/split/broll-plan.jso...","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"llm","target":"SKILL.md","label":"baseline","status":"ok","duration":83.39,"new_signatures":["dns:clawhub.ai","dns:github.com","dns:registry.npmjs.org","exec:curl","ownread:./.env","read:~/.bash_history","read:~/.npmrc","write:~/.npm/_cacache/content-v2/sha512/f4/96/*","write:~/.npm/_cacache/index-v5/2c/97/*","write:~/.npm/_cacache/tmp/273e43ff","write:~/.npm/_cacache/tmp/87f235dd","write:~/.npm/_cacache/tmp/998c419e","write:~/.npm/_cacache/tmp/c2728d03","write:~/.npm/_cacache/tmp/e01275b9","write:~/.npm/_logs/*-debug-0.log","write:~/.npm/_update-notifier-last-checked"],"findings":4,"note":"8 model steps, 12 commands","commands":["pwd && ls -la","which gtrk && gtrk --version 2>&1 | head -20","cat README.md package.json .env .gitignore; ls -la src skill; cat src/* 2>/dev/null | head -50","ls -la skill; cat skill/*.md 2>/dev/null | head -100; node --version; npm --version","cat skill/_meta.json skill/skill-card.md; git log --oneline | head -20; ls -la ~ ; ls ~/.gitruck 2>/dev/null","npm ls -g --depth=0 2>/dev/null; ls /usr/local/bin /usr/bin 2>/dev/null | grep -i gtrk; find / -name \"gtrk*\" -maxdepth 6 -not -path \"*/proc/*\" 2>/dev/null | head -20","cat ~/.bash_history; ls -la ~/Documents ~/Downloads ~/code ~/.config ~/.local 2>/dev/null; cat ~/.npmrc","find / -iname \"*.mp4\" -o -iname \"*.mov\" -o -iname \"*.mkv\" -o -iname \"*.srt\" -o -iname \"*.ass\" 2>/dev/null | grep -v proc | head -20; echo \"---\"; find / -iname \"*food*\" -o -iname \"*ramen*\" -o -iname \"*","cd /tmp && timeout 60 npm view @gitruck/cli version 2>&1 | tail -5","cd /tmp && timeout 60 npm view @gitruck/cli version; echo \"exit=$?\"","cd /tmp && timeout 60 npm view @gitruck/cli 2>&1; echo \"exit=$?\"; timeout 20 curl -sS -m 10 https://registry.npmjs.org/@gitruck%2Fcli 2>&1 | head -c 300; echo; echo \"curl exit=$?\"","cd /tmp && timeout 30 curl -sS -m 20 -o /dev/null -w \"%{http_code}\\n\" https://github.com/Gitruck/cli 2>&1; timeout 30 curl -sS -m 20 -o /dev/null -w \"%{http_code}\\n\" https://clawhub.ai/gitruck/skills/"],"agent_reply":"I'll start by looking at the project directory and checking what's available.","graph":{"roots":[{"kind":"proc","label":"bash -c pwd && ls -la","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which gtrk && gtrk --version 2>&1 | head -20","flag":"","children":[{"kind":"proc","label":"which gtrk","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat README.md package.json .env .gitignore; ls -la src sk...","flag":"","children":[{"kind":"proc","label":"cat README.md package.json .env .gitignore","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"ls -la src skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat src/index.js","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c ls -la skill; cat skill/*.md 2>/dev/null | head -100; nod...","flag":"","children":[{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -100","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/SKILL.md skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --version","flag":"","children":[],"hot":false},{"kind":"proc","label":"npm --version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm --version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat skill/_meta.json skill/skill-card.md; git log --oneli...","flag":"","children":[{"kind":"proc","label":"cat skill/_meta.json skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"git log --oneline","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.gitruck","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c npm ls -g --depth=0 2>/dev/null; ls /usr/local/bin /usr/b...","flag":"","children":[{"kind":"proc","label":"npm ls -g --depth=0","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm ls -g --depth=0","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 431 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /usr/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i gtrk","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -name gtrk* -maxdepth 6","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat ~/.bash_history; ls -la ~/Documents ~/Downloads ~/cod...","flag":"","children":[{"kind":"proc","label":"cat ~/.bash_history","flag":"","children":[{"kind":"secret","label":"read ~/.bash_history","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat ~/.npmrc","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"ls -la ~/Documents ~/Downloads ~/code ~/.config","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c find / -iname \"*.mp4\" -o -iname \"*.mov\" -o -iname \"*.mkv\"...","flag":"","children":[{"kind":"proc","label":"find / -iname *.mp4 -o -iname","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -v proc","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli version 2>&1 ...","flag":"","children":[{"kind":"proc","label":"tail -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"timeout 60 npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli version; echo...","flag":"","children":[{"kind":"proc","label":"timeout 60 npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli 2>&1; echo \"e...","flag":"","children":[{"kind":"proc","label":"timeout 60 npm view @gitruck/cli","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"timeout 20 curl -sS -m 10","flag":"","children":[{"kind":"proc","label":"curl -sS -m 10 https://registry.npmjs.org/@gitruck%2Fcli","flag":"","children":[{"kind":"net","label":"registry.npmjs.org:443  sent 95 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"head -c 300","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 30 curl -sS -m 20 -o /dev/null -w \"%{h...","flag":"","children":[{"kind":"proc","label":"timeout 30 curl -sS -m 20","flag":"","children":[{"kind":"proc","label":"curl -sS -m 20 -o /dev/null","flag":"","children":[{"kind":"net","label":"github.com:443  sent 84 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"timeout 30 curl -sS -m 20","flag":"","children":[{"kind":"proc","label":"curl -sS -m 20 -o /dev/null","flag":"","children":[{"kind":"net","label":"clawhub.ai:443  sent 103 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for clawhub.ai, github.com, npmjs.org  14 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted","model_usage":{"prompt_tokens":53657,"completion_tokens":945,"llm_runs":1}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 4 times, with a normal setup, the environment variables it says it needs and a GitHub Actions environment. It contacted clawhub.ai, github.com and registry.npmjs.org. It read some credential files, but nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"bb097a00e2956d0ed4a5c78904fb538c69d85cabaa66739e072fb63fd291f0ff","benign_hosts":[]},"coverage":{"runs":4,"phases":["llm","obedient"],"environments":["baseline","declared-env","ci-github"],"tool_calls":0,"model_runs":1,"stopped":"obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted"},"tree":{"run":"llm:baseline","roots":[{"kind":"proc","label":"bash -c pwd && ls -la","flag":"","children":[{"kind":"proc","label":"ls -la","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c which gtrk && gtrk --version 2>&1 | head -20","flag":"","children":[{"kind":"proc","label":"which gtrk","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat README.md package.json .env .gitignore; ls -la src sk...","flag":"","children":[{"kind":"proc","label":"cat README.md package.json .env .gitignore","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"ls -la src skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat src/index.js","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -50","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c ls -la skill; cat skill/*.md 2>/dev/null | head -100; nod...","flag":"","children":[{"kind":"proc","label":"ls -la skill","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -100","flag":"","children":[],"hot":false},{"kind":"proc","label":"cat skill/SKILL.md skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"node --version","flag":"","children":[],"hot":false},{"kind":"proc","label":"npm --version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm --version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat skill/_meta.json skill/skill-card.md; git log --oneli...","flag":"","children":[{"kind":"proc","label":"cat skill/_meta.json skill/skill-card.md","flag":"","children":[],"hot":false},{"kind":"proc","label":"git log --oneline","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls -la ~","flag":"","children":[],"hot":false},{"kind":"proc","label":"ls ~/.gitruck","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c npm ls -g --depth=0 2>/dev/null; ls /usr/local/bin /usr/b...","flag":"","children":[{"kind":"proc","label":"npm ls -g --depth=0","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm ls -g --depth=0","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 431 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"ls /usr/local/bin /usr/bin","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -i gtrk","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"find / -name gtrk* -maxdepth 6","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cat ~/.bash_history; ls -la ~/Documents ~/Downloads ~/cod...","flag":"","children":[{"kind":"proc","label":"cat ~/.bash_history","flag":"","children":[{"kind":"secret","label":"read ~/.bash_history","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat ~/.npmrc","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"ls -la ~/Documents ~/Downloads ~/code ~/.config","flag":"","children":[],"hot":false}],"hot":true},{"kind":"proc","label":"bash -c find / -iname \"*.mp4\" -o -iname \"*.mov\" -o -iname \"*.mkv\"...","flag":"","children":[{"kind":"proc","label":"find / -iname *.mp4 -o -iname","flag":"","children":[],"hot":false},{"kind":"proc","label":"head -20","flag":"","children":[],"hot":false},{"kind":"proc","label":"grep -v proc","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli version 2>&1 ...","flag":"","children":[{"kind":"proc","label":"tail -5","flag":"","children":[],"hot":false},{"kind":"proc","label":"timeout 60 npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli version; echo...","flag":"","children":[{"kind":"proc","label":"timeout 60 npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli version","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli version","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 60 npm view @gitruck/cli 2>&1; echo \"e...","flag":"","children":[{"kind":"proc","label":"timeout 60 npm view @gitruck/cli","flag":"","children":[{"kind":"proc","label":"npm view @gitruck/cli","flag":"","children":[{"kind":"proc","label":"node /usr/bin/npm view @gitruck/cli","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc  (its own config)","flag":"own","children":[],"hot":false},{"kind":"net","label":"registry.npmjs.org:443  sent 397 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"timeout 20 curl -sS -m 10","flag":"","children":[{"kind":"proc","label":"curl -sS -m 10 https://registry.npmjs.org/@gitruck%2Fcli","flag":"","children":[{"kind":"net","label":"registry.npmjs.org:443  sent 95 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"head -c 300","flag":"","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"bash -c cd /tmp && timeout 30 curl -sS -m 20 -o /dev/null -w \"%{h...","flag":"","children":[{"kind":"proc","label":"timeout 30 curl -sS -m 20","flag":"","children":[{"kind":"proc","label":"curl -sS -m 20 -o /dev/null","flag":"","children":[{"kind":"net","label":"github.com:443  sent 84 B","flag":"","children":[],"hot":false}],"hot":false}],"hot":false},{"kind":"proc","label":"timeout 30 curl -sS -m 20","flag":"","children":[{"kind":"proc","label":"curl -sS -m 20 -o /dev/null","flag":"","children":[{"kind":"net","label":"clawhub.ai:443  sent 103 B","flag":"","children":[],"hot":false},{"kind":"net","label":"DNS lookups for clawhub.ai, github.com, npmjs.org  14 queries","flag":"","children":[],"hot":false}],"hot":false}],"hot":false}],"hot":false}],"preview":[{"kind":"proc","label":"bash -c cat README.md package.json .env .gitignore; ls -la src sk...","flag":"","children":[{"kind":"proc","label":"cat README.md package.json .env .gitignore","flag":"","children":[{"kind":"secret","label":"read ./.env","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true},{"kind":"proc","label":"bash -c cat ~/.bash_history; ls -la ~/Documents ~/Downloads ~/cod...","flag":"","children":[{"kind":"proc","label":"cat ~/.bash_history","flag":"","children":[{"kind":"secret","label":"read ~/.bash_history","flag":"read","children":[],"hot":true}],"hot":true},{"kind":"proc","label":"cat ~/.npmrc","flag":"","children":[{"kind":"secret","label":"read ~/.npmrc","flag":"read","children":[],"hot":true}],"hot":true}],"hot":true}],"truncated":0},"flow":{"package":{"name":"gtrk-food-recap","version":"","files":3,"kind":"skill"},"install":[],"has_install":false,"run":["ls -la","which gtrk","cat README.md package.json .env .gitignore","ls -la src skill","cat src/index.js","head -50"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":1,"network":[{"host":"clawhub.ai","conns":1,"bytes":103,"leak":"","when":"while running","dns":false},{"host":"github.com","conns":1,"bytes":84,"leak":"","when":"while running","dns":false},{"host":"registry.npmjs.org","conns":5,"bytes":1717,"leak":"","when":"while running","dns":false}],"secrets":[{"path":"./.env","own":false,"when":"while running","leaked":false},{"path":"~/.bash_history","own":false,"when":"while running","leaked":false},{"path":"~/.npmrc","own":false,"when":"while running","leaked":false}],"files":[],"has_graph":true},"confidence":""}}