Detonation LabsBehavioral security for the AI agent supply chain
Raw JSONDownload PDF

Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, a GitHub Actions environment and cloud credentials present. It made no network connections. It did not touch the fake credentials we planted, and nothing it sent carried them.

0 findings. Scanned 26 Oct 2026 by detonator 0.5.1.

Target
xinjianxue-tarot
Source
clawhub 1.0.0
SHA-256
80ed05182216b922
Files
7
RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

batch:clawhub:2026-10-26

What this package does

observed across 4 runs
  1. Package xinjianxue-tarot 7 files · agent skill
  2. Install No install stepFiles were copied in as they are.
  3. Runs as ls -Rcat SKILL.mdhead -5cat api.md An AI agent also used it 1 time.
  4. What it reached
    Network

    No connections.

    Credentials

    None of the planted fake keys were touched.

    Files written

    Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

No findings. Detonator observed no malicious or suspicious behavior in the runs below.

Process tree

run llm:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree
  • runbash -c cd ./skill && ls -R && echo "-----" && cat SKILL.md | hea...
    • runls -R
    • runcat SKILL.md
    • runhead -5
  • runbash -c cd ./skill/references && cat api.md && echo "=====PAYMENT...
    • runcat api.md
    • runcat payment.md
  • runbash -c cd ./skill/references && cat spreads.md
    • runcat spreads.md
  • runbash -c cd ./skill/references && cat reading.md && echo "=====CAR...
    • runcat reading.md
    • runcat ../skill-card.md
    • runcat ../_meta.json

Exploration log

4 runs
  1. obedient:baseline ok · 0.6s

    no new behavior

    $ 第 1 位（将要或想要摆脱的）：宝剑五 逆位 第 2 位（需要留意的）：圣杯二 正位 第 3 位（最终结果）：星币八 正位
  2. obedient:ci-github ok · 0.7s

    no new behavior

    $ 第 1 位（将要或想要摆脱的）：宝剑五 逆位 第 2 位（需要留意的）：圣杯二 正位 第 3 位（最终结果）：星币八 正位
  3. obedient:cloud-creds ok · 0.4s

    no new behavior

    $ 第 1 位（将要或想要摆脱的）：宝剑五 逆位 第 2 位（需要留意的）：圣杯二 正位 第 3 位（最终结果）：星币八 正位
  4. llm:baseline ok · 8.5s

    no new behavior · 4 model steps, 4 commands

    $ cd ./skill && ls -R && echo "-----" && cat SKILL.md | head -5 $ cd ./skill/references && cat api.md && echo "=====PAYMENT=====" && cat payment.md $ cd ./skill/references && cat spreads.md $ cd ./skill/references && cat reading.md && echo "=====CARD=====" && cat ../skill-card.md && echo "=====META=====" && cat ../_meta.json model said: I've read the skill. Before I can do a reading, I need two things from you — the skill can't pick your numbers for you. ### 先确认你要问的事 请告诉我： 1. **你想问什么**（一件具体的事：感情、事业、人际、某个选择） 2. **想要什么结果、时间范围**（比如「三个月内要不要换工作」） ### 然后我会做三件事 1. **定阵**：从 50 种牌阵里挑一个最贴合的，并告诉你每个位次问的是什么。 2. **请你报号码**：牌堆共 78 张，心里想着这件事，报 N 个 1~78 的整数，不能重复（N 由牌阵决定，1~7 张）。 3. **出牌解读**：服务端按你报的顺序出牌，我逐张贴位次解读，最后给结论和一个可以马上做的小动作。 ### 需要你知道的两点

obedient: coverage plateau (2 runs with no new behavior); llm: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.