Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

1 finding. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: human-ai-role-redesign
Source: clawhub 1.0.0
SHA-256: 83fc9278d4d6a9c8
Files: 5

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 1 run

Package human-ai-role-redesign 5 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as ls -lahead -100find . -maxdepth 3 -not -pathhead -50 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cat README.md; echo "=== package.json"; cat package.json;...
- runcat .env
  - secretread ./.env

View full process tree

runbash -c ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git...
- runls -la
- runhead -100
- runfind . -maxdepth 3 -not -path
runbash -c ls -R ./skill 2>/dev/null | head -50
- runhead -50
- runls -R ./skill
runbash -c cat README.md; echo "=== package.json"; cat package.json;...
- runcat .env
  - secretread ./.env
- runcat README.md
- runcat package.json
- runcat src/index.js
- runhead -20
- rungit log --oneline
runbash -c cat skill/examples/klarna-ai-assistant-customer-service-2...
- runcat skill/examples/klarna-ai-assistant-customer-service-2024-...
- runcat skill/references/sources.md
- runcat skill/_meta.json
runbash -c cat skill/examples/klarna-ai-assistant-customer-service-2...
- runcat skill/examples/klarna-ai-assistant-customer-service-2024-...
- runcat skill/skill-card.md

Exploration log

1 run

llm:baseline ok · 39.1s

new behavior: ownread:./.env · token budget reached

$ ls -la; echo "---"; find . -maxdepth 3 -not -path '*/.git/*' -type f | head -100 $ ls -R ./skill 2>/dev/null | head -50 $ cat README.md; echo "=== package.json"; cat package.json; echo "=== src/index.js"; cat src/index.js; echo "=== .env"; cat .env; echo "=== git log"; git log --oneline | head -20 $ cat skill/examples/klarna-ai-assistant-customer-service-2024-2025.md; echo "=== sources"; cat skill/references/sources.md; echo "=== meta"; cat skill/_meta.json $ cat skill/examples/klarna-ai-assistant-customer-service-2024-2025.md; echo "=== card"; cat skill/skill-card.md $ $ $ $ $ model said: I'll start by looking at the project to see what context exists for this role redesign.

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.