ClawHub
Back to skill

Security audit

geoskill-change-detection-dl

Security checks across malware telemetry and agentic risk

Overview

The main change-detection tool is mostly local and coherent, but the package also bundles under-disclosed credential, network geocoding, caching, and downloader helpers unrelated to the stated offline workflow.

Review this package before installing in a sensitive environment. The documented change-detection command appears local, but the shipped package contains extra geospatial core modules that can access credential locations, use hardcoded Earthdata fallback credentials, call external geocoding services, download files, and cache AOI data under the home directory. Install only if those bundled capabilities are acceptable or after removing/splitting them and pinning dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares itself as offline/local and lists only simple package dependencies, yet the static analysis indicates capabilities for environment access, file read/write, shell, and network use without any declared permissions. This is dangerous because users and orchestrators cannot make informed trust decisions, and hidden access to local files or network endpoints can expose secrets or enable unintended data movement even if the nominal purpose is image change detection.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is a local GPU-based change detection model, but the analyzed behavior reportedly includes credential harvesting paths (.netrc, env, secrets files), hardcoded fallback Earthdata credentials, geocoding/network access, and a generic downloader/registry toolset unrelated to the stated task. This mismatch is highly dangerous because unrelated credential and network functionality greatly expands the attack surface, can leak sensitive data, and suggests the skill may perform actions users would not reasonably expect from an offline raster-analysis tool.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The vendored manifest claims the bundled core came from a different skill ('landsat-download') than the declared skill being analyzed. This breaks provenance and makes it harder to verify that the included code matches the expected functionality, increasing supply-chain and review risk because unrelated or stale components could be silently shipped under misleading metadata.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim). That creates a real privacy and data-flow issue because sensitive user queries can leave the local environment, and this behavior is not constrained to strictly offline operation despite the skill's stated offline-first framing. In the context of a change-detection skill, unexpected outbound network requests are more suspicious because they expand the trust boundary beyond model inference.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file adds broad place-name geocoding and network AOI resolution behavior that is outside the declared deep-learning change-detection purpose, which is a strong indicator of unnecessary capability expansion. Even if not overtly malicious, hidden or unjustified network-enabled functionality increases attack surface, can exfiltrate user-supplied locations or queries to third parties, and makes the skill harder to review and trust.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code performs outbound HTTP requests to Open-Meteo and Nominatim, sending user-provided place names and headers to external services without any clear connection to the stated change-detection model purpose. In a skill that is supposed to do local GPU-based change detection, undisclosed external resolution can leak sensitive AOI information, create privacy/compliance issues, and introduce dependency on untrusted network responses.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
User-provided place queries are transmitted to third-party geocoding services without any disclosure mechanism in this file. Even if the data seems low sensitivity, location queries can reveal operational interests, target areas, or user intent, which is especially relevant in geospatial analysis workflows. The absence of explicit notice/consent makes this a genuine privacy weakness.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The file persists query-derived AOI results under the user's home directory by default, creating undeclared local retention of potentially sensitive location lookups. Cached place names and bounding boxes may expose mission targets or analyst interests to other local users, backup systems, or forensic review. In a geospatial change-detection context, that stored metadata can be more sensitive than ordinary application cache data.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code embeds hardcoded fallback credentials, including a plaintext Earthdata username and password, directly in source. Anyone with repository or package access can recover and misuse them, and any consumer of this helper may silently authenticate with these credentials without explicit operator intent.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
99% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
torch
Confidence
91% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
torch
Confidence
91% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
torch
Confidence
92% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
torch
Confidence
95% confidence
Finding
torch

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
80% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
82% confidence
Finding
scipy

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical
Category
Supply Chain
Confidence
94% confidence
Finding
torch

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15