Verdict

No malicious behavior observed

We ran it 1 time, with a normal setup. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

0 findings. Scanned 27 Oct 2026 by detonator 0.5.1.

Target: urban-suspense-storyboard
Source: clawhub 1.0.0
SHA-256: 110ed50e01ba9ada
Files: 9

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-27

What this package does

observed across 1 run

Package urban-suspense-storyboard 9 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as head -50ls -R ./skillcat references/rhythm-and-emotion.mdcat references/prompt-formula.md An AI agent also used it 1 time.
What it reached
Network
No connections.

Credentials
None of the planted fake keys were touched.

Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

No findings. Detonator observed no malicious or suspicious behavior in the runs below.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c ls -R ./skill | head -50
- runhead -50
- runls -R ./skill
runbash -c cd skill; cat references/rhythm-and-emotion.md; echo ====...
- runcat references/rhythm-and-emotion.md
- runcat references/prompt-formula.md
- runcat references/compliance-checklist.md
runbash -c cd skill; cat examples/convenience-store-8-shots.md; echo...
- runcat examples/convenience-store-8-shots.md
- runcat README.md
runbash -c cd skill; head -40 examples/convenience-store-8-shots.md
- runhead -40 examples/convenience-store-8-shots.md

Exploration log

1 run

llm:baseline ok · 16.0s

no new behavior · 4 model steps, 4 commands

$ ls -R ./skill | head -50 $ cd skill; cat references/rhythm-and-emotion.md; echo ======; cat references/prompt-formula.md; echo =====; cat references/compliance-checklist.md $ cd skill; cat examples/convenience-store-8-shots.md; echo ====; cat README.md $ cd skill; head -40 examples/convenience-store-8-shots.md model said: 【项目制作计划】 **实际使用参数**：剧情梗概=暴雨夜末班地铁，女孩发现对面乘客的倒影在车窗里比她慢半拍；镜头数量=8；画面风格=写实CG电影光影；平台=抖音+快手；单镜时长=5–7s；角色设定=自动生成；禁忌项=无。 **基础参数**：9:16 / 1080×1920 / 30fps（生成阶段 24fps，成片统一 30fps）/ 总时长 52s / 8 镜 / 写实 CG 电影光影 / 抖音 + 快手。 **角色外观锚点（逐镜原样复制，不得换词）** - 女主：22 岁亚洲女性、齐肩黑直发、额前薄刘海、米色针织开衫、白色内搭、黑色帆布包、无浓妆。 - 男乘客：40 岁亚洲男性、寸头、灰蓝旧夹克、深色长裤、左手腕旧手表、神情平静。 **节奏分段** | 段落 | 时间 | 镜号 | 功能 | | --- | --- | --- | --- | | 安全感建立 | 0–12s

llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.