ClawHub
Back to skill

Security audit

geoskill-carbon-flux-estimation

Security checks across malware telemetry and agentic risk

Overview

The main carbon-flux tool appears local and purpose-aligned, but the package also ships under-disclosed credential and geocoding helpers with hardcoded NASA Earthdata credentials and optional third-party location lookups.

Review before installing. The documented CLI is an offline local carbon-flux calculator, but the package includes extra helper code for credentials, downloads, and geocoding that is not disclosed in the skill instructions. Do not install it in an environment with sensitive ~/.netrc, ~/.geoskill/secrets.json, or environment credentials unless those helper modules are removed or audited; the embedded Earthdata credential should also be removed and rotated by the publisher.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions, yet its documented and detected capabilities include shell, file read/write, environment access, and network. This creates a trust-boundary problem: users and orchestrators may treat the skill as offline and low-risk while it can access local data and external services, enabling unintended data exposure or side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is simple carbon-flux estimation, but the analyzed behavior includes geocoding, external HTTP access, credential management, local secret-file reads, and even fallback NASA Earthdata credentials. This mismatch is dangerous because it conceals sensitive capabilities unrelated to the core task, increasing the risk of secret harvesting, unexpected outbound requests, and overprivileged execution under a scientific-looking description.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The module sends user-supplied place queries to external services (Open-Meteo and optionally Nominatim), which can disclose sensitive location intent or operational context outside the local environment. In a carbon-flux estimation skill, this is more concerning because geographies of interest may reflect private project sites, study areas, or customer locations, and the disclosure is implicit rather than explicitly consented.

Context-Inappropriate Capability

Low
Confidence
72% confidence
Finding
The code persists resolved queries and AOI metadata under the user's home directory, which can leave a local history of potentially sensitive locations. This is a privacy issue rather than a direct system-compromise bug, but it can expose analyst interests or project areas to other local users, backup systems, or later forensic review.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The documentation states that passwords are not hardcoded in source, yet `_DEFAULTS` contains a literal Earthdata username and password. Hardcoded credentials are a direct secret exposure risk: anyone with source access can reuse them, and they may propagate into forks, package caches, backups, or logs.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The comments claim passwords are not cached and are read on each call, but `load_user_secrets()` loads values once into the process-wide `_DEFAULTS` dictionary and retains them in memory. This inconsistency increases exposure in long-lived processes and can mislead reviewers or operators about the actual secret-handling properties of the code.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file implements place-resolution and geocoding behavior that is materially broader than the manifest’s stated carbon-flux estimation purpose. In a skill ecosystem, this kind of capability mismatch is dangerous because it expands the data-handling and network-access surface, making it easier to collect or transmit user location queries under the guise of an unrelated scientific function.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module makes outbound requests to third-party geocoding services using user-supplied place strings, but that network access is not clearly justified by the stated skill purpose alone. Unnecessary external calls increase privacy, supply-chain, and reliability risk because user inputs and metadata are shared with external providers whenever this path is exercised.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
Location queries are transmitted to third-party geocoding endpoints without any user-facing disclosure or consent mechanism in the code path. Given the skill's domain, place names may correspond to sensitive land parcels, research sites, or customer assets, so silent disclosure to outside services creates a meaningful privacy and data-governance risk.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module embeds fallback credentials directly in `_DEFAULTS`, including a real-looking username and password. In a credential-management module, this is especially dangerous because callers are encouraged to centralize secret retrieval here, making the hardcoded secret easy to consume silently and difficult to notice during normal use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code sends raw user-provided place queries to Open-Meteo and Nominatim without any user-facing warning or consent mechanism in this file. Even if the data is 'only' a place name, it may reveal sensitive location intent, research targets, or operational context, and disclosure to third parties is a privacy-relevant event.

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
78% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")
Confidence
76% confidence
Finding
.netrc

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
72% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
78% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15