ClawHub
Back to skill

Security audit

geoskill-disaster-exposure-assessment

Security checks across malware telemetry and agentic risk

Overview

The advertised tool is a local disaster-exposure calculator, but the package also includes undisclosed network, downloader, cache, and credential-handling code outside that purpose.

Install only if you are comfortable with a package that contains extra, undocumented geospatial support code beyond the advertised CLI. Prefer removing the unused credential, downloader, and place-resolution modules or running it in an isolated environment, and pin dependencies before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions while the detected capabilities include file access, shell, environment-variable access, network, and file writing. This is dangerous because users and policy systems cannot accurately assess or constrain what the skill may do, and in this skill’s context the undocumented network and credential-adjacent capabilities are unnecessary for the stated offline geospatial overlay task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is local disaster exposure assessment, but the finding indicates unrelated capabilities: online geocoding/weather access, a generic downloader, credential harvesting from environment and secret files, and even default Earthdata credentials. This mismatch is highly dangerous because it expands the attack surface far beyond the stated purpose, enables secret access and outbound communication, and may conceal data exfiltration or unauthorized remote fetches behind a benign geospatial workflow.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored core metadata declares the skill as 'landsat-download', which does not match this package’s stated disaster exposure assessment purpose. This kind of identity mismatch can break provenance checks, confuse reviewers and automation, and allow the wrong vendored dependency set to be trusted or audited under an incorrect skill name.

Description-Behavior Mismatch

Medium
Confidence
77% confidence
Finding
The code persistently stores user-supplied place queries and resolved AOI data under the user’s home directory by default, which can expose sensitive locations or investigative targets to other local users, backups, or later unintended reuse. While not an RCE-style flaw, it is a privacy-relevant data persistence issue because the behavior is on by default and not surfaced here as an explicit consent step.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
User-provided place names are transmitted to an external geocoding service without any disclosure or consent mechanism in this module. Location queries can be sensitive operational data, especially in a disaster exposure assessment context where queried places may reveal assets, populations, or incident focus areas.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The fallback behavior sends the same user query to a second external provider, increasing third-party exposure of potentially sensitive location data without separate disclosure. Multi-provider fallback broadens the privacy surface and may violate user expectations if they believed resolution was local or limited to one service.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module hardcodes a real-looking fallback username and password in source code. Hardcoded credentials are dangerous because anyone with source access can reuse them, and any deployment that forgets to override them may silently authenticate with shared static secrets, enabling unauthorized access and credential leakage.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User-supplied place queries are sent to external geocoding providers, which can expose potentially sensitive location intent or operational context to third parties without explicit notice or consent. In a disaster-exposure workflow, queried locations may reflect sensitive assets, populations, or incident areas, making this data disclosure more concerning than in a generic mapping tool.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
Confidence
93% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
93% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
93% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
94% confidence
Finding
geopandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
rasterio
scipy
geopandas
shapely
Confidence
92% confidence
Finding
shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15