{"id":"uOq-hZCPcUXjR1z7HFy_2g","status":"done","kind":"skill","source":"clawhub","target":"clawhub:mochi-csv-workbench","name":"mochi-csv-workbench","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":0,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-26T17:15:52.570621Z","finished_at":"2026-10-26T19:44:29.862293Z","report_url":"https://detonationlabs.com/r/uOq-hZCPcUXjR1z7HFy_2g","progress":[{"phase":"scripts","label":"baseline","status":"ok","duration":1.5,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":1.1,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"time-travel","status":"ok","duration":0.9,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":1.4,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"time-travel","status":"ok","duration":0.8,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"baseline","status":"ok","duration":9.2,"new":[],"findings":[],"note":""},{"phase":"scripts","label":"guided:CURL_CA_BUNDLE,DENO_CERT,GIT_SSL_CAINFO,NODE_TEST_CONTEXT…","status":"ok","duration":10.3,"new":["write:./true/coverage-13-*-0.json","write:./true/coverage-20-*-0.json","write:./true/coverage-27-*-0.json","write:./true/coverage-34-*-0.json","write:./true/coverage-41-*-0.json"],"findings":[],"note":""}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-26T19:44:29Z","target":{"name":"mochi-csv-workbench","sha256":"1713c23fd1e31a526e7a9c85057383eb595d868352334386912a770ffb52a9a4","files":11,"scripts":["scripts/csv.mjs","scripts/io.mjs","tests/csv.test.mjs"],"declared":{},"trigger_hints":["schedule"],"kind":"skill","source":"clawhub:mochi-csv-workbench"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":[],"files_written":["./true/coverage-13-*-0.json","./true/coverage-20-*-0.json","./true/coverage-27-*-0.json","./true/coverage-34-*-0.json","./true/coverage-41-*-0.json","./true/coverage-48-*-0.json","./true/coverage-55-*-0.json","./true/coverage-62-*-0.json","./true/coverage-69-*-0.json","./true/coverage-76-*-0.json"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[],"exploration":{"runs":[{"phase":"scripts","target":"scripts/csv.mjs","label":"baseline","status":"ok","duration":1.458,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/csv.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/csv.mjs","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":1.139,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/csv.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/csv.mjs","label":"time-travel","status":"ok","duration":0.909,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/csv.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/io.mjs","label":"baseline","status":"ok","duration":1.369,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/io.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/io.mjs","label":"guided:WATCH_REPORT_DEPENDENCIES","status":"ok","duration":0.791,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/io.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"scripts/io.mjs","label":"time-travel","status":"ok","duration":0.793,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/scripts/io.mjs","flag":"","children":[],"hot":false}],"truncated":0}},{"phase":"scripts","target":"tests/csv.test.mjs","label":"baseline","status":"ok","duration":9.246,"new_signatures":[],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/tests/csv.test.mjs","flag":"","children":[{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-lmN7Q9/grouped","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-eKAFM4/invalid","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-iCsFPL/result","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-XAFnsm/result","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-oPeGPT/input.csv --out /tmp/mochi-csv-test-oPeGPT/out","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-k9fXIi/bad.csv --out /tmp/mochi-csv-test-k9fXIi/out","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-uSqBlN/link/a.csv --out /tmp/mochi-csv-test-uSqBlN/out","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-uSqBlN/real/a.csv --out /tmp/mochi-csv-test-uSqBlN/link/out","flag":"","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-M01w35/out","flag":"","children":[],"hot":false}],"hot":false}],"truncated":0}},{"phase":"scripts","target":"tests/csv.test.mjs","label":"guided:CURL_CA_BUNDLE,DENO_CERT,GIT_SSL_CAINFO,NODE_TEST_CONTEXT…","status":"ok","duration":10.317,"new_signatures":["write:./true/coverage-13-*-0.json","write:./true/coverage-20-*-0.json","write:./true/coverage-27-*-0.json","write:./true/coverage-34-*-0.json","write:./true/coverage-41-*-0.json","write:./true/coverage-48-*-0.json","write:./true/coverage-55-*-0.json","write:./true/coverage-62-*-0.json","write:./true/coverage-69-*-0.json","write:./true/coverage-76-*-0.json"],"findings":0,"note":"","commands":[],"agent_reply":"","graph":{"roots":[{"kind":"proc","label":"node <skill>/tests/csv.test.mjs","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-13-1793043868389-0.json","flag":"write","children":[],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-o99hZF/grouped","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-20-1793043860258-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-ouI7cH/invalid","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-27-1793043860944-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-uq21Lh/result","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-34-1793043861931-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-vMPRx7/result","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-41-1793043862915-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-cEQ9eH/input.csv --out /tmp/mochi-csv-test-cEQ9eH/out","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-48-1793043863694-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-OgrjoN/bad.csv --out /tmp/mochi-csv-test-OgrjoN/out","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-55-1793043864643-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-2kKjpi/link/a.csv --out /tmp/mochi-csv-test-2kKjpi/out","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-62-1793043865234-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input /tmp/mochi-csv-test-2kKjpi/real/a.csv --out /tmp/mochi-csv-test-2kKjpi/link/out","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-69-1793043866421-0.json","flag":"write","children":[],"hot":false}],"hot":false},{"kind":"proc","label":"/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-fnZJy0/out","flag":"","children":[{"kind":"file","label":"wrote ./true/coverage-76-1793043867911-0.json","flag":"write","children":[],"hot":false}],"hot":false}],"hot":false}],"truncated":0}}],"stopped":"scripts/scripts/csv.mjs: coverage plateau (2 runs with no new behavior); scripts/scripts/io.mjs: coverage plateau (2 runs with no new behavior); scripts/tests/csv.test.mjs: run budget spent; llm: run budget spent","model_usage":{"prompt_tokens":0,"completion_tokens":0,"llm_runs":0}},"surface":{},"startup":{},"partial_scan":"","note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"We ran it 8 times, with a normal setup, WATCH_REPORT_DEPENDENCIES set, the clock moved a year ahead and CURL_CA_BUNDLE and DENO_CERT and GIT_SSL_CAINFO and NODE_TEST_CONTEXT… set. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":[],"ips":[],"sha256":"1713c23fd1e31a526e7a9c85057383eb595d868352334386912a770ffb52a9a4","benign_hosts":[]},"coverage":{"runs":8,"phases":["scripts"],"environments":["baseline","guided:WATCH_REPORT_DEPENDENCIES","time-travel","guided:CURL_CA_BUNDLE,DENO_CERT,GIT_SSL_CAINFO,NODE_TEST_CONTEXT…"],"tool_calls":0,"model_runs":0,"stopped":"scripts/scripts/csv.mjs: coverage plateau (2 runs with no new behavior); scripts/scripts/io.mjs: coverage plateau (2 runs with no new behavior); scripts/tests/csv.test.mjs: run budget spent; llm: run budget spent"},"tree":{"run":"scripts:baseline","roots":[{"kind":"proc","label":"node <skill>/scripts/csv.mjs","flag":"","children":[],"hot":false}],"preview":[],"truncated":0},"flow":{"package":{"name":"mochi-csv-workbench","version":"","files":11,"kind":"skill"},"install":[],"has_install":false,"run":["node <skill>/scripts/csv.mjs","node <skill>/scripts/io.mjs","node <skill>/tests/csv.test.mjs","/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-lmN7Q9/grouped","/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-eKAFM4/invalid","/usr/bin/node <skill>/scripts/csv.mjs --input - --out /tmp/mochi-csv-test-iCsFPL/result"],"tools":[],"startup":"","partial":"","tool_calls":0,"agent_runs":0,"network":[],"secrets":[],"files":[{"path":"./true/coverage-13-1793043868389-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-20-1793043860258-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-27-1793043860944-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-34-1793043861931-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-41-1793043862915-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-48-1793043863694-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-55-1793043864643-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-62-1793043865234-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-69-1793043866421-0.json","persist":false,"when":"while running"},{"path":"./true/coverage-76-1793043867911-0.json","persist":false,"when":"while running"}],"has_graph":true},"confidence":""}}