ClawHub
Back to skill

Security audit

geoskill-crop-health-diagnosis

Security checks across malware telemetry and agentic risk

Overview

The advertised crop-health tool is mostly local, but the package also bundles undisclosed network, credential, and location-cache helpers, including hardcoded Earthdata credentials.

Review before installing. The main command appears intended for local crop-health raster analysis, but the package should remove or clearly document unused network and credential helpers, eliminate the hardcoded Earthdata password, disclose any geocoding/cache behavior, and pin dependencies before it is treated as a routine install.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill documentation declares no permissions, yet the detected capabilities include environment access, filesystem read/write, network access, and shell execution. This creates a transparency and trust problem: users may run the skill believing it is local and limited, while it may access credentials, invoke commands, or fetch remote data. In a geospatial processing context, some of these capabilities may be functionally plausible, but they must be explicitly disclosed and permission-gated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is offline crop-health diagnosis, but the detected behavior includes geocoding, remote downloads, external service helpers, credential handling for multiple providers, and even hardcoded fallback NASA Earthdata credentials. This is a significant behavior mismatch that can expose secrets, trigger unexpected network activity, and broaden the attack surface far beyond what a user would reasonably expect from the description. The hardcoded fallback credentials are especially concerning because they indicate insecure secret handling.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The code sends user-supplied place names to third-party geocoding services over the network, which creates a privacy and data-governance risk if users do not expect external disclosure. In a crop-health skill, AOI lookup may be useful, but transmitting potentially sensitive farm or site names to Open-Meteo and Nominatim expands data exposure beyond local processing.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User-entered place queries are transmitted to external geocoding providers without any visible disclosure or consent mechanism in this code path. For agricultural use cases, place names can reveal sensitive operational locations such as farms, fields, or facilities, so silent third-party transmission creates a meaningful privacy risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code persists resolved query/manfiest data into a cache file in the user's home directory without any disclosure, retention policy, or access-control hardening. Cached AOI queries may expose sensitive locations over time to other local users, backups, or forensic inspection, especially on shared systems.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module contains hardcoded fallback Earthdata credentials in source code, including a plaintext username and password. Any execution path that falls back to these defaults can silently authenticate to an external account, causing credential leakage, unauthorized service use, and potential compromise if the repository is shared or published. In this skill context, a geospatial data-processing workflow legitimately accesses remote datasets, so embedded credentials are more dangerous because they are likely to be exercised during normal operation rather than lying dormant.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The code sends raw user-supplied place queries to third-party geocoding services without any disclosure or consent mechanism in this component. That can leak sensitive location intent or personally identifying place names to external providers, which is a real privacy/security issue even if the technical impact is limited.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
93% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
91% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15