ClawHub
Back to skill

Security audit

Satellite Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a coherent satellite-tracking skill that fetches public Celestrak orbit data and keeps a small local cache, with no evidence of credential use or unrelated behavior.

Before installing, expect the skill to access Celestrak for public TLE data and update a local tle_cache.json file. Install sgp4 from a trusted source, and treat any request for API keys, tokens, or broader filesystem access as unexpected for this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions in metadata, but the documented behavior clearly implies network access to fetch Celestrak TLE data and local file writes for JSON caching. This creates a transparency and policy-enforcement gap: a host system may treat the skill as requiring no privileges while it actually performs privileged operations, which can lead to unexpected outbound connections or filesystem modifications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal