ClawHub
Back to skill

Security audit

ArcGIS Pro深度学习训练数据补全

Security checks for vulnerabilities and agentic risk

Overview

This ArcGIS training-data repair skill is mostly coherent, but it can permanently delete existing JSON and EMD files in the selected dataset without preview, confirmation, or backup.

Review before installing. Use this only on a copied or backed-up ArcGIS training-data directory, because running it can delete existing .json and .emd files in the dataset root. The package shows no network exfiltration, credential access, or persistence, but the deletion behavior should be changed to a dry run or explicit cleanup flag before broad use.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to scan directories, write a Python script, and execute it, which implies file read/write capability without any declared permission model or user-facing guardrails. This creates a real security issue because the skill can modify local data and inspect filesystem contents while giving the user no clear notice of that access scope.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script is presented as a repair tool for missing ArcGIS training-data metadata, but it also deletes any existing .emd files except esri_model_definition.emd and any .json files except esri_accumulated_stats.json in the target directory. That behavior is destructive, exceeds the stated '补全/complete missing files' purpose, and can remove valid user metadata or auxiliary dataset files without consent.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The cleanup loop deletes unrelated JSON files in the dataset root solely based on extension and name mismatch, which can destroy user-maintained metadata, labels, configuration, or provenance files. In a training-data directory, arbitrary JSON is plausible and important, so extension-based deletion is unsafe and unjustified.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The rule stating that the script will automatically clean non-standard .emd/.json files indicates potential deletion or overwrite of existing files, but this destructive behavior is not clearly disclosed in the skill description. That is dangerous because users may lose manually created metadata or unrelated JSON/EMD artifacts in the dataset directory without informed consent or a backup path.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script performs destructive deletion in the user-supplied target directory without any warning, preview, confirmation, or backup. Because the path is entirely user-controlled and may contain valuable metadata, a simple execution mistake can cause irreversible data loss.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
Pillow
# GDAL (osgeo) 是可选依赖，ArcGIS Pro 环境自带
# 如果运行环境没有GDAL，脚本会自动降级使用PIL读取影像
Confidence
95% confidence
Finding
The dependency is unpinned, so installs may resolve to different NumPy versions over time, including versions with known flaws or breaking changes. In a data-processing skill that handles external image/training inputs, unpredictable dependency resolution increases supply-chain and reliability risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
Pillow
# GDAL (osgeo) 是可选依赖，ArcGIS Pro 环境自带
# 如果运行环境没有GDAL，脚本会自动降级使用PIL读取影像
Confidence
96% confidence
Finding
Pillow is also unpinned, which allows environment-dependent installation of arbitrary newer or older versions. Because this skill processes image files from training datasets, using an uncontrolled image library version increases exposure to parser vulnerabilities and inconsistent behavior.

Static analysis

No suspicious patterns detected.