ClawHub
Back to skill

Security audit

geoskill-ecosystem-services-valuation

Security checks across malware telemetry and agentic risk

Overview

The main valuation tool appears local, but the package includes undisclosed network, credential, and cache functionality that does not fit the documented offline-only purpose.

Review before installing. The advertised valuation command appears to run locally, but the package carries extra code that can use network geocoding, download files, read local credential stores, cache place lookups under the home directory, and exposes hardcoded Earthdata credentials. Install only if you trust the publisher and are comfortable removing or auditing the unused bundled modules first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
A documented ecosystem-valuation skill that also includes geocoding, HTTP downloading, credential handling, and reads secrets from ~/.geoskill/secrets.json or ~/.netrc is a serious description-behavior mismatch. Hidden network and credential-access functionality can enable unexpected data exfiltration, unauthorized external access, or misuse of stored credentials, especially because the markdown claims offline/local-only behavior.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The vendored metadata shows this skill includes a core package for 'landsat-download' with modules such as safe_download.py, sensors.py, and checks.py, which is broader than the stated ecosystem valuation-only purpose. Unnecessary download capability expands the attack surface and may enable unexpected network access or data acquisition behavior that users would not reasonably expect from this skill.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The presence of credentials.py in a valuation-focused skill indicates credential-handling capability that is not justified by the declared functionality in this file. Secret-handling code in an unexpected context increases the risk of credential collection, misuse, accidental exposure, or future abuse through hidden authenticated network operations.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The AOI resolver sends user-supplied place names to Open-Meteo and optionally Nominatim, creating outbound network traffic that is not reflected in the skill description of local valuation/output. Location queries can contain sensitive or proprietary sites, so this behavior introduces an unexpected data disclosure and dependency on third-party services.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The module persists AOI query results under the user's home directory, even though the skill description does not mention creating local cache artifacts. Place names and derived AOI manifests may reveal sensitive work locations or research targets, and persistent storage expands the privacy and forensic footprint of the skill.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The module hardcodes a fallback Earthdata username and password in source code, which is a direct secret exposure and creates unauthorized authentication capability for anyone with code access. Even if intended as a fallback, embedding live credentials in a distributed skill materially increases risk of account compromise, reuse, and unapproved network access.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This code sends user-supplied place queries to external third-party geocoding services (Open-Meteo and optionally Nominatim), creating an outbound data flow not clearly disclosed by the skill's stated valuation purpose. Even if the data is only a place name, it can expose sensitive user intent, locations of interest, or internal project names to external services and can violate least-privilege/network-minimization expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User location queries are transmitted to third-party geocoding providers without any explicit disclosure or consent mechanism in this code path. In a geospatial valuation skill, AOIs can encode commercially sensitive project sites or personal locations, so silent transmission materially increases privacy risk.

Missing User Warnings

High
Confidence
96% confidence
Finding
The file silently loads secrets from hardcoded fallbacks and a user-home secrets file without any user-facing disclosure or consent boundary. Combined with embedded credentials, this can cause unanticipated authentication to external services and makes it easier for a skill to access sensitive accounts without clear operator awareness.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The Nominatim request hard-codes an Accept-Language preference for Chinese without user choice or documentation. While not code-execution dangerous, it can bias returned results, leak an implicit locale preference, and produce unexpected or misleading geocoding outcomes for non-Chinese users or deployments.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
99% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
geopandas
shapely
Confidence
93% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
geopandas
shapely
Confidence
93% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
geopandas
shapely
Confidence
95% confidence
Finding
geopandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
geopandas
shapely
Confidence
91% confidence
Finding
shapely

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15