ClawHub
Back to skill

Security audit

geoskill-edge-detection-lineament

Security checks across malware telemetry and agentic risk

Overview

The main edge-detection tool is mostly local, but the package also ships under-disclosed geocoding, download, caching, and credential code including hardcoded credentials.

Treat this as a review-before-install package. The core edge-detection script can run locally, but users should prefer a cleaned build that removes the unused geocoding, downloader, and credential modules or explicitly documents them. Do not rely on the bundled hardcoded credentials, and avoid invoking the place-resolution helpers unless you accept third-party geocoding requests and home-directory cache writes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (45)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill manifest declares no permissions, yet the analyzed capability set includes environment access, file read/write, network, and shell execution. This creates a transparency and trust problem: users may run a seemingly local geospatial skill without understanding it can access the filesystem, invoke commands, or make outbound requests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose is simple offline edge detection, but the detected behavior includes geocoding, caching, HTTP download logic, credential handling for multiple services, and even hardcoded fallback credentials. This mismatch is dangerous because it can conceal data exfiltration, unauthorized remote access, or secret exposure behind an innocuous geospatial workflow, and hardcoded credentials are a direct security weakness.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The vendored metadata declares the packaged core as belonging to the different skill 'landsat-download' even though this package is presented as an edge-detection/lineament extraction skill. This kind of metadata mismatch breaks provenance and makes it harder to verify that the bundled code is the expected dependency set, creating supply-chain confusion and increasing the risk that unrelated or unsafe functionality is shipped unnoticed.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The vendored file list includes download, sensor, safe_download, checks, and credentials modules that are unrelated to the declared purpose of edge/lineament extraction. In this context, unexpected network-access and credential-handling capabilities enlarge the attack surface and may enable hidden data access, remote fetching, or secret misuse if the bundled code is invoked directly or indirectly.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file adds AOI geocoding, network access, and persistent caching to a skill whose declared purpose is edge detection and lineament extraction. That scope mismatch is dangerous because user-supplied place names are transmitted to third-party services and persisted locally, expanding the skill's data exposure and attack surface beyond what a user would reasonably expect.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code performs outbound HTTP requests to Open-Meteo and Nominatim using user-provided place queries, even though the skill is described as image edge detection rather than geocoding. In this context, the behavior can leak sensitive location interest, create hidden external dependencies, and violate least-privilege expectations for an offline/local processing skill.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The default cache directory is placed under the user's home directory, enabling persistent storage of resolved AOI queries and results outside the immediate task lifecycle. In a skill not advertised as storing geocoding history, this creates unnecessary privacy and data-retention risk, especially on shared systems.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This edge-detection skill ships a centralized credential manager for multiple unrelated external services, which materially expands its attack surface beyond the declared purpose. In this file, the broad auth support is not merely dead documentation: it actively reads secrets from environment variables, ~/.netrc, and ~/.geoskill/secrets.json, creating unnecessary access paths to sensitive credentials in a context that should not need them.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The module supports OpenAI, FIRMS, CMA, Earthdata, and EOG credentials despite the skill being described as Canny/Sobel edge detection plus Hough line extraction. That mismatch increases suspicion because the code can access multiple credential classes unrelated to the advertised task, enabling secret harvesting or unintended external-service use if other parts of the skill invoke these helpers.

Context-Inappropriate Capability

Medium
Confidence
71% confidence
Finding
The code adds unrestricted outbound HTTP(S) retrieval and writes attacker-controlled response data to a caller-chosen local path, which expands the skill’s capabilities beyond its stated image-processing role. In this skill context, unexpected network access is more dangerous because it can fetch untrusted external content or enable SSRF-style access to internal resources if URLs are user-influenced, and integrity checking is optional rather than enforced.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file implements place-name geocoding and AOI resolution, which is materially outside the declared edge/lineament detection purpose of the skill. In an agent skill context, undeclared capability expansion is dangerous because it enables hidden data flows and outbound lookups on user input that users and reviewers would not expect.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code performs outbound HTTP requests to Open-Meteo and Nominatim using user-supplied place queries, creating an external exfiltration path for user input. Because the manifest describes edge detection rather than geocoding, this network capability is unjustified and increases the risk of covert data disclosure, dependency abuse, and policy bypass.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The module docstring openly states that this file is an adapter for AOI/place resolution, which contradicts the stated edge-detection purpose of the skill. This mismatch is a security concern because it signals undeclared functionality and makes it easier for unexpected code paths and data handling to evade normal review expectations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Place queries are sent to third-party geocoding services without any user-facing disclosure in this file, which is a privacy and transparency issue. In the context of a geospatial processing skill that appears local/offline in purpose, silent transmission of location-related input is especially risky because users may not expect their AOI interests to leave the system.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code writes resolved place data to a persistent cache in the user's home directory without a visible notice or consent mechanism. This can create a hidden history of user queries and geospatial interests, which is a privacy concern and may expose sensitive operational context on multi-user or managed environments.

Missing User Warnings

High
Confidence
100% confidence
Finding
The file contains hardcoded fallback credentials, including a non-empty Earthdata username and password. Hardcoded secrets in source are a direct secret-exposure vulnerability: anyone with code access can recover them, and any deployment lacking explicit overrides may silently authenticate with those credentials, risking account compromise, abuse, and credential reuse exposure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
User-provided place names are transmitted to third-party services without any explicit warning or consent mechanism in this file. Even if the data seems low sensitivity, location-related queries can reveal user interests, projects, or operational targets, making silent transmission a privacy and trust issue.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The code hardcodes an Accept-Language preference of zh-CN for Nominatim requests without user choice or clear justification. This can affect returned results and leaks an implementation-specific locale preference to the external provider, which is unnecessary metadata exposure and may produce unexpected behavior for non-Chinese users.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
75% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
75% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
75% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
76% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
82% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
82% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
84% confidence
Finding
.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15