ClawHub
Back to skill

Security audit

Satellite Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it tracks satellites using public orbital data, with modest disclosed network and cache behavior.

Before installing, be aware that it fetches public TLE data from Celestrak, writes a local cache file, uses Chinese/Beijing-time output by default, and installs `sgp4` without a pinned version. Use reasonable `--passes` and `--watch` values to avoid long-running local work.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:38
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38-42
Vulnerability Type: Unpinned dependency and mutable supply-chain input
Risk Level: Medium

Vulnerable Code

markdown
## Installation / 安装

```bash
pip install sgp4
text

### Technical Analysis

The installation instructions retrieve `sgp4` without specifying an audited version or requiring package integrity hashes. Consequently, the package artifact and dependency graph resolved by pip can change between installations.

This does not demonstrate that the current `sgp4` package is malicious. However, it creates a supply-chain exposure in which a compromised future release, package-index substitution, or maliciously configured pip index could supply attacker-controlled installation or runtime code. Python packages may execute code during source builds, installation, or subsequent import.

### Attack Path

1. A user or Agent follows the documented `pip install sgp4` instruction.
2. Pip contacts its configured package index and resolves the latest compatible package because no version is pinned.
3. An attacker who has compromised the package, distribution channel, or configured index provides a malicious package artifact.
4. Pip installs or builds that artifact.
5. Attacker-controlled code executes during installation, build processing, or when `track.py` imports `sgp4.api`.

### Impact Assessment

Malicious dependency code would run with the privileges of the user who performs the installation or invokes the Skill. Depending on those privileges, the code could read or modify user-accessible files, access environment variables and credentials, initiate network connections, or execute additional processes. No privilege escalation beyond the invoking user's existing permissions is established by the reviewed code.
Remediation
View remediation

Remediation Suggestions

  • Pin sgp4 to a specifically reviewed version rather than resolving an unrestricted latest release.

  • Maintain dependencies in a lock or requirements file containing cryptographic hashes.

  • Install with hash enforcement, for example:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  • Generate the locked hashes from a trusted environment and review dependency updates before changing them.

  • Document the intended trusted package index and avoid relying on uncontrolled global pip configuration.

  • Prefer prebuilt, verified wheels where practical and run installation with the minimum required user privileges.

T09 · Insecure Skill Coding Practices

Note
Location
track.py:205
Finding

Unbounded Pass-Prediction Workload Enables Local Resource Exhaustion

Content
View full analysis

Vulnerability Details

File Location: track.py:205, track.py:278, track.py:344
Vulnerability Type: Missing validation and upper bound on computational workload
Risk Level: Low

Vulnerable Code

The iteration ceiling is calculated directly from the caller-controlled pass count:

python
max_iterations = count * 1200  # 足够多步数

The command-line argument accepts any integer without an upper bound:

python
parser.add_argument("--passes", type=int, default=5, help="预测过境次数")

The unvalidated value is then passed to the prediction routine:

python
passes = predict_passes(line1, line2, obs_lat, obs_lon, args.passes)

Technical Analysis

The value supplied through --passes directly controls max_iterations in predict_passes(). Each iteration can perform an SGP4 orbital calculation, coordinate transformations, and trigonometric distance calculations. No maximum value, wall-clock timeout, cancellation mechanism, or resource budget is enforced.

A sufficiently large positive value can therefore cause prolonged CPU usage and make an Agent invocation effectively unavailable. The issue is most relevant when an automated Agent constructs command-line arguments from an untrusted request. Negative values do not produce the same exhaustion behavior because Python's range() is empty for a negative iteration ceiling.

Attack Path

  1. An attacker supplies or induces a tracking request that asks for an extremely large number of passes.

  2. An Agent maps that request to an invocation such as:

    bash
    python3 track.py --id 25544 --observer 28.2,112.9 --passes 100000000

  3. argparse accepts the integer without range validation.

  4. predict_passes() computes an iteration ceiling of 100000000 * 1200.

  5. The process repeatedly performs orbital and trigonometric calculations, consuming CPU time and delaying or blocking the Agent task until it is externally termi ...[truncated 406 chars]

Remediation
View remediation

Remediation Suggestions

  • Enforce a small documented range immediately after argument parsing, such as 1 through 20.

  • Use an argparse validation function so invalid values are rejected before prediction begins:

    python
    def bounded_pass_count(value):
    count = int(value)
    if not 1 <= count <= 20:
        raise argparse.ArgumentTypeError("--passes must be between 1 and 20")
    return count

parser.add_argument(
    "--passes",
    type=bounded_pass_count,
    default=5,
    help="Number of predicted passes, from 1 to 20",
)

  • Add an independent maximum iteration limit so internal callers cannot bypass command-line validation.

  • Enforce a wall-clock deadline or cancellation mechanism around long-running predictions.

  • Apply operating-system CPU and execution-time limits when the Skill is exposed through an automated or multi-user Agent service.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises network access and local cache writes in its behavior, but the manifest declares no explicit tool scope or permissions. In an agent environment, this creates an authorization ambiguity where a seemingly harmless tracking skill can perform outbound requests and write files without clear user or platform consent, increasing the chance of unintended data access or persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module title, data-source description, and surrounding user-facing text are written only in Chinese, and the rest of the CLI help/output follows the same pattern. This imposes a specific language/locale on users without any opt-in or alternative, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The examples present timestamps specifically as '北京时间' (Beijing Time), which suggests the skill may default to a fixed locale/timezone rather than adapting to user preference. Because the documentation does not state that users can choose their language or timezone, this creates a natural-language policy concern around imposing a locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.