Verdict

No malicious behavior observed

We ran it 7 times, with a normal setup, LC_MESSAGES set, docs:--country US --year and a GitHub Actions environment. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

2 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target: pto-maximizer
Source: clawhub 1.0.0
SHA-256: 59c4337b303a32b2
Files: 7

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 7 runs

Package pto-maximizer 7 files · agent skill
Install No install stepFiles were copied in as they are.
Runs as python3 <skill>/scripts/pto_planner.pypython3 <skill>/scripts/pto_planner.py --country US --yearpython3 scripts/pto_planner.py --country US --year 2026python3 scripts/pto_planner.py --country UK --year 2026 An AI agent also used it 1 time.
What it reached
Network
No connections.
Credentials
- ./.envread
Files written
- ./pto_2026.icswritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Loaded the project's .env file

Confidence: Info The package loaded the project's .env file.
Observed in: llm:baseline

Description

The process loaded the project's .env file. Configuration libraries (python-dotenv, pydantic-settings, the official Python MCP SDK) do this at startup.

Impact

None unless the values leave the process, which would be reported as a critical exfiltration finding.

Evidence

./.env (by cat)

Remediation

No action needed. Keep long-lived secrets out of project .env files where possible.

F02 Low

Agent put secrets in the model's context (may be the agent's own choice)

Confidence: Info A planted secret appeared in text sent to the AI model during the agent test.
Observed in: llm:baseline

Description

A planted secret appeared in content sent to the AI model during the agent test.

Impact

The model provider saw the value; it did not leave through the package.

Evidence

./.env (dotenv)

Remediation

Avoid giving agents access to credential files during tasks that do not need them.

References

OWASP LLM02:2025 Sensitive Information Disclosure

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

runbash -c cd /home/user 2>/dev/null; cd -; cat README.md package.js...
- runcat README.md package.json .env .gitignore
  - secretread ./.env

View full process tree

runbash -c ls -la; echo ---; ls -la skill; echo ---; find skill -typ...
- runls -la
- runls -la skill
- runfind skill -type f
- runhead -50
runbash -c date; python3 --version
- rundate
- runpython3 --version
runbash -c cd skill; cat README.md; echo ---; cat _meta.json; echo -...
- runcat README.md
- runcat _meta.json
- runcat skill-card.md
- runcat references/pto-strategy.md
runbash -c cd skill; cat scripts/pto_planner.py
- runcat scripts/pto_planner.py
runbash -c cd skill; head -120 scripts/pto_planner.py
- runhead -120 scripts/pto_planner.py
runbash -c cd /home/user 2>/dev/null; cd -; cat README.md package.js...
- runcat README.md package.json .env .gitignore
  - secretread ./.env
- runls src
- rungit log --oneline
- runhead
runbash -c cd skill; sed -n 120,260p scripts/pto_planner.py
- runsed -n 120,260p scripts/pto_planner.py
runbash -c cd skill; sed -n 100,125p scripts/pto_planner.py
- runsed -n 100,125p scripts/pto_planner.py
runbash -c cd skill; sed -n 125,150p scripts/pto_planner.py
- runsed -n 125,150p scripts/pto_planner.py
runbash -c cd skill; sed -n 150,175p scripts/pto_planner.py
- runsed -n 150,175p scripts/pto_planner.py
runbash -c cd skill; python3 scripts/pto_planner.py --country US --y...
- runpython3 scripts/pto_planner.py --country US --year 2026
- runhead -20 /tmp/t.ics

Exploration log

7 runs

scripts:baseline ok · 1.6s

no new behavior
scripts:guided:LC_MESSAGES ok · 1.0s

no new behavior
scripts:docs:--country US --year ok · 1.9s

no new behavior
obedient:baseline ok · 9.4s

new behavior: write:./pto_2026.ics

$ python3 scripts/pto_planner.py --country US --year 2026 --budget 15 python3 scripts/pto_planner.py --country UK --year 2026 --budget 25 python3 scripts/pto_planner.py --country US --year 2026 --budget
obedient:guided:LC_MESSAGES ok · 7.3s

no new behavior

$ python3 scripts/pto_planner.py --country US --year 2026 --budget 15 python3 scripts/pto_planner.py --country UK --year 2026 --budget 25 python3 scripts/pto_planner.py --country US --year 2026 --budget
obedient:ci-github ok · 5.5s

no new behavior

$ python3 scripts/pto_planner.py --country US --year 2026 --budget 15 python3 scripts/pto_planner.py --country UK --year 2026 --budget 25 python3 scripts/pto_planner.py --country US --year 2026 --budget
llm:baseline ok · 18.8s

new behavior: ownread:./.env · 8 model steps, 11 commands

$ ls -la; echo ---; ls -la skill; echo ---; find skill -type f | head -50 $ date; python3 --version $ cd skill; cat README.md; echo ---; cat _meta.json; echo ---; cat skill-card.md; echo ---; cat references/pto-strategy.md $ cd skill; cat scripts/pto_planner.py $ cd skill; head -120 scripts/pto_planner.py $ cd /home/user 2>/dev/null; cd -; cat README.md package.json .env .gitignore; ls src; git log --oneline | head $ cd skill; sed -n 120,260p scripts/pto_planner.py $ cd skill; sed -n 100,125p scripts/pto_planner.py $ cd skill; sed -n 125,150p scripts/pto_planner.py $ cd skill; sed -n 150,175p scripts/pto_planner.py model said: I'll start by exploring the skill directory and the project.

scripts/scripts/pto_planner.py: coverage plateau (2 runs with no new behavior); obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.