ClawHub
Back to skill

Security audit

geoskill-cyclone-damage-assessment

Security checks across malware telemetry and agentic risk

Overview

The cyclone tool itself is mostly local, but the package includes undisclosed vendored network, geocoding, and credential-management code with hardcoded Earthdata credentials and mismatched provenance metadata.

Review before installing. The main cyclone assessment command appears local, but this package carries extra network and credential-management code that is not needed for the advertised workflow. Do not rely on the embedded Earthdata credentials; remove them, rotate the account if they are real, pin dependencies, and regenerate vendored metadata before publishing or deploying in a sensitive environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises local/offline geospatial processing, yet the detected capabilities include network, shell, environment access, and file read/write without any declared permissions or justification. That mismatch weakens least-privilege controls and can hide unexpected data access or command execution paths from reviewers and users.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a strong description-behavior mismatch: the skill claims cyclone damage estimation, but the analyzed behavior includes unrelated geocoding, generalized remote downloading, credential handling for multiple external services, and embedded fallback secrets. Such hidden breadth materially increases attack surface and creates risk of secret leakage, unexpected exfiltration, and abuse of external accounts.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the surrounding cyclone-damage-assessment package. This is a supply-chain integrity problem because provenance and review assumptions can be broken: operators may believe they are using audited cyclone-related components when the metadata indicates a mismatched package origin, making tampering, accidental code substitution, or mis-packaging harder to detect.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User-supplied place names are sent to external geocoding providers without any disclosure or consent mechanism in this module. Place queries can contain sensitive location information, so silent transmission to third parties creates a privacy/data-handling risk, especially in disaster or infrastructure assessment contexts where queried locations may be operationally sensitive.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
Hard-coding the Accept-Language header to Chinese without user choice can leak locale assumptions and influence provider-side profiling or response behavior. While lower severity than direct data exfiltration, it is still a privacy and transparency issue because request metadata is sent externally in a way the caller may not expect.

Missing User Warnings

High
Confidence
99% confidence
Finding
This module hardcodes a real-looking Earthdata username and password as fallback credentials. Even if intended as a convenience default, embedding secrets in source creates immediate credential exposure to anyone with code access and can enable unauthorized third-party use of the associated external account.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The code hard-codes `Accept-Language: zh-CN,zh;q=0.9` for all Nominatim lookups, regardless of user preference or query context. This can disclose locale assumptions, produce localized results the user did not request, and create privacy/fingerprinting concerns or incorrect geocoding behavior for non-Chinese users; however, it is not a direct code-execution or auth-bypass issue.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
83% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
84% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15