ClawHub
Back to skill

Security audit

China Coord Transform

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, user-run coordinate conversion tool that reads and writes user-selected map data files without hidden persistence or unrelated data access.

Install this if you need local coordinate conversion and are comfortable running Python over files you choose. Review output paths before running batch/vector commands because they create or overwrite destination files, and follow the skill’s own warning not to use the approximate GCJ-02 method for legal, surveying, emergency, or other high-accuracy uses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions, yet its documented behavior clearly includes shell execution via `python` and file read/write operations for CSV, GeoJSON, and Shapefile batch conversion. This creates a capability/permission mismatch that can mislead a host platform or user about what the skill can access, increasing the risk of unintended file modification or processing of attacker-controlled paths.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.