ClawHub
Back to skill

Security audit

geoskill-data-cube-construction

Security checks across malware telemetry and agentic risk

Overview

This skill’s main tool looks like a local data-cube builder, but the package also includes under-disclosed network, downloader, and credential-handling code that users should review before installing.

Review this skill before installing it in sensitive environments. The main data-cube command appears local, but the package includes unused or under-documented modules that can perform network requests, cache location lookups, read local credential stores, and use embedded Earthdata fallback credentials. Prefer a version that removes or clearly gates the downloader/geocoder/credential modules and pins dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (39)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions, yet its documented/code-detected capabilities include environment access, file read/write, shell execution, and network access. This creates a transparency and least-privilege failure: users and policy engines may treat the skill as low-risk while it can access sensitive local data, invoke commands, and communicate externally. In the context of a skill advertised as offline-capable data-cube construction, the undeclared breadth of capability makes the mismatch more concerning.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a significant description-behavior mismatch: the skill is presented as a local remote-sensing data-cube builder, but analysis indicates geocoding, online downloads, caching, credential management, environment/.netrc/secrets-file reads, and even hardcoded fallback Earthdata credentials. Such hidden behaviors can expose secrets, trigger unintended network egress, and mislead users into running a tool under false assumptions about privacy and scope. The hardcoded credential fallback is especially dangerous because embedded credentials are insecure and may enable unauthorized access or credential leakage.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The vendored metadata declares a different capability ('landsat-download') than the skill’s advertised purpose of offline xarray/NetCDF data-cube construction. This kind of capability mismatch is dangerous because it can conceal undeclared data acquisition behavior, expand the skill’s effective attack surface, and defeat operator expectations about offline-only operation.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
Including a bundled set of download-oriented modules such as safe_download.py and credentials.py in an allegedly offline data-cube construction skill introduces hidden functionality that is not obviously required. In context, this makes the skill more dangerous because users may run it under the assumption that it performs only local processing, while the package may contain logic for remote access, credential handling, or unreviewed code paths.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The code sends user-supplied place names to external services (Open-Meteo and Nominatim), which creates an undeclared outbound data flow inconsistent with the advertised offline construction mode. This can leak sensitive AOI queries such as project sites, field locations, or customer areas to third parties, especially because the network behavior is automatic fallback rather than explicit opt-in.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The module centralizes access to many unrelated credentials, including OpenAI, CMA, FIRMS, EOG, and Earthdata, even though the stated skill purpose is offline geospatial data-cube construction. Broad secret-access capability increases blast radius: any code path importing this helper can silently gain access to multiple user secrets far beyond what is needed for offline processing.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Support for retrieving OPENAI_API_KEY is not justified by an offline data-cube construction skill and creates an unnecessary path to a valuable third-party credential. Even without direct exfiltration in this file, exposing a helper that fetches AI API keys materially expands what a compromised or overly broad skill can access.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Automatic access to ~/.netrc and ~/.geoskill/secrets.json gives the skill broad ability to read user-home credential stores, which is disproportionate for an offline processing tool. This makes the skill context more dangerous because the declared use case does not prepare users to expect sensitive local secret discovery.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The docstring says passwords are not cached, but load_user_secrets persists secrets in the in-memory _DEFAULTS dict after first load. This mismatch can cause unsafe operational assumptions, leading developers or users to underestimate secret retention in long-lived processes.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The Earthdata token docstring claims a .netrc account-field fallback, but get_earthdata_token() only calls _resolve() and never parses account from .netrc. This is primarily a security-relevant correctness issue: operators may believe token sourcing works one way while the code behaves differently, causing insecure fallbacks or unintended use of hardcoded defaults.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The exported resolve_place() API performs network-backed place resolution and delegates to a geocoding core module, which materially expands the skill's behavior beyond the stated offline data-cube construction purpose. In an agent setting, this can exfiltrate user-supplied place names and trigger unintended outbound requests, creating privacy, policy, and supply-chain risk that is not obvious from the manifest.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The legacy fallback directly queries external Open-Meteo and Nominatim services using user-provided place strings, despite the skill being described as supporting offline composition. This mismatch makes outbound data disclosure and dependency on third-party services easy to trigger, which is especially risky for sensitive locations or restricted execution environments.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User-provided location queries are transmitted to third-party geocoding services without any consent, warning, or in-code disclosure to the caller. Place names can contain sensitive operational or personal information, so silent exfiltration to external APIs creates a real privacy and data-governance risk in environments expecting local/offline processing.

Missing User Warnings

High
Confidence
100% confidence
Finding
The source contains hardcoded fallback credentials for EARTHDATA_USERNAME and EARTHDATA_PASSWORD. Hardcoded secrets in source control are directly exposed to anyone with repository access and may enable unauthorized use of the external account; in an offline skill, their presence is especially unjustified and suspicious.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The Nominatim request hard-codes Accept-Language to Chinese, which leaks an implementation or operator preference and can alter returned place metadata without user choice. While not severe on its own, it introduces unnecessary privacy and correctness concerns by biasing responses and potentially surprising downstream consumers.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
92% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
92% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
88% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
91% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
91% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
94% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:
Confidence
94% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val
Confidence
89% confidence
Finding
.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15