ClawHub
Back to skill

Security audit

fire-hotspot-download

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward NASA FIRMS fire-data downloader, with manageable cautions around API-key handling and dependency version hygiene.

Install only if you are comfortable storing a free NASA FIRMS API key locally and sending it to NASA FIRMS for each request. Prefer using the FIRMS_API_KEY environment variable in shared environments, avoid committing config files or command histories containing the key, and install with updated dependency versions rather than old minimum releases.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The privacy notice is inaccurate because the FIRMS API key is included directly in the request URL, so more than the stated bounding box, date range, and instrument data are transmitted. Embedding secrets in URLs is dangerous because URLs can be logged by client software, proxies, server access logs, browser history, and monitoring systems, increasing the chance of credential exposure.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The skill instructs users to store an API key locally and send authenticated requests to an external service, but it does not clearly warn that secrets will be persisted to disk or transmitted over the network. This can lead to accidental exposure of credentials in shared environments, checked-in config files, or logs, especially because the config is stored near the script rather than in a dedicated secret store.

Unpinned Dependencies

Low
Category
Supply Chain
Content
fire_hotspot_download
requests>=2.28.0
tqdm>=4.64.0
Confidence
96% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fire_hotspot_download
requests>=2.28.0
tqdm>=4.64.0
Confidence
78% confidence
Finding
tqdm>=4.64.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
requests==2.28.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low
Category
Supply Chain
Confidence
83% confidence
Finding
tqdm==4.64.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_fire-hotspot-download.py:27