ClawHub
Back to skill

Security audit

geoskill-drought-vulnerability-index

Security checks across malware telemetry and agentic risk

Overview

The main drought calculator is local, but the package also contains undisclosed credential, network, download, and cache helpers, including a hardcoded Earthdata password.

Review this package carefully before installing. The documented drought-index command appears local, but the distributed artifact contains extra helpers that can use network services, read local credential stores, and ship a hardcoded Earthdata credential. Prefer a cleaned version with those helpers removed or clearly documented, credentials deleted and rotated, caching made opt-in, and dependencies pinned.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
73% confidence
Finding
The skill declares an offline/local geospatial analysis workflow, but the detected capabilities include network, shell, environment access, and file read/write without any explicit permission declaration or disclosure. That gap can mislead users and host systems about what the skill may access, increasing the risk of unintended data exposure or command execution if the underlying implementation actually uses those capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a significant description-behavior mismatch: the skill presents itself as a local drought-vulnerability calculator, but the analyzed behavior includes network access, credential handling, local caching, a downloader, and even hardcoded default NASA Earthdata credentials. Hidden network and secret-access functionality materially expands the attack surface and could lead to credential leakage, unauthorized outbound connections, or misuse of user files under the guise of a simple offline analysis tool.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The module explicitly hardcodes a default Earthdata username and password while claiming not to hardcode passwords in source. Embedded credentials in a distributed codebase are a direct secret exposure risk and can lead to unauthorized account use, credential reuse compromise, and downstream data-access abuse.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
The batch API accepts arbitrary URLs and caller-controlled filenames, then writes downloaded content to a caller-selected output directory without any allowlist or destination-path validation. In an agent context, this broad remote fetch-and-write primitive can be abused for SSRF, retrieval of untrusted payloads, or writing files outside the intended workspace if filename contains traversal sequences.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
User-supplied place queries are transmitted to third-party geocoding services (Open-Meteo and optionally Nominatim) with no disclosure or consent mechanism in this code path. Place names can reveal sensitive user interests, travel plans, assets, or operational locations, so silent transmission creates a privacy leak to external services and their logs.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Resolved queries are persisted under the user's home directory in a predictable cache location without user-facing notice or opt-in. This creates a local privacy exposure because sensitive place names and derived AOI data remain on disk and may be readable by other local processes, backups, or later users of the same account.

Natural-Language Policy Violations

Medium
Confidence
75% confidence
Finding
The code hard-codes an Accept-Language header of zh-CN for Nominatim requests, overriding user or environment locale without consent. This can leak assumptions about user context, produce biased or unexpected results, and create avoidable privacy and compliance issues when requests are sent to third-party services.

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:
Confidence
84% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")
Confidence
88% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
99% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
86% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15