ClawHub
Back to skill

Security audit

geoskill-format-batch-converter

Security checks across malware telemetry and agentic risk

Overview

The advertised converter is local, but the package also includes undisclosed network geocoding, download, and credential-handling code that does not fit that purpose.

Review this skill before installing. The primary converter appears to work locally, but the package ships extra modules that can contact third-party geocoding services, download arbitrary URLs, read credential sources, and contains hardcoded credentials. Install only if you accept that broader bundled code or after those modules and credentials are removed or clearly gated and documented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (44)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation declares no permissions, yet the detected capabilities include filesystem access, shell execution, environment access, and network use. This creates a trust and transparency gap: users may run the skill expecting only local format conversion, while the implementation may access broader resources than necessary, increasing risk if the code is compromised or behaves unexpectedly.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
There is a substantial mismatch between the stated purpose of an offline/local GDAL batch converter and the reported behavior, which includes external HTTP access, downloading, geocoding, credential handling, and even embedded fallback secrets. Hidden network and secret-management functionality in a seemingly local data-processing skill is especially dangerous because it can exfiltrate data, misuse credentials, or perform unreviewed remote interactions outside user expectations.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The vendored metadata claims this package is for 'landsat-download' while the surrounding skill metadata describes a GDAL/OGR batch format converter. This mismatch undermines supply-chain integrity and traceability because reviewers and tooling can no longer reliably verify that the bundled core files belong to the intended skill, increasing the risk of accidental code substitution or concealed reuse of incompatible components.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This module performs outbound geocoding requests to Open-Meteo and optionally Nominatim, which expands the skill from offline/batch format conversion into networked data exfiltration behavior. Even if the queried data is only place names, user inputs and workflow metadata are disclosed to third-party services without being inherent to the declared converter purpose.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code issues HTTP requests to third-party geocoding endpoints despite the skill being described as a GDAL/OGR batch format converter. This creates unnecessary network dependency and privacy exposure, and in restricted environments can violate policy or leak sensitive location queries outside the local processing boundary users would reasonably expect.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This module introduces broad credential-management capabilities for Earthdata, FIRMS, CMA, OpenAI, and EOG that are not justified by the skill’s stated purpose of offline/batch GDAL/OGR format conversion. Scope expansion like this materially increases the attack surface and enables access to unrelated third-party accounts and tokens if other parts of the skill invoke these helpers.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code reads secrets from environment variables, ~/.geoskill/secrets.json, and ~/.netrc/_netrc for multiple external services, giving the skill broad access to user credentials outside its declared function. In the context of a format-conversion skill, this is overprivileged behavior and creates a clear path for credential harvesting or misuse by any code path that imports this module.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring claims passwords are not cached, but load_user_secrets() copies secret values into the process-global _DEFAULTS dict and retains them for subsequent calls. This discrepancy can lead operators to underestimate secret lifetime in memory and weakens expected secret-handling guarantees in long-lived processes.

Context-Inappropriate Capability

Medium
Confidence
70% confidence
Finding
The module allows arbitrary outbound HTTP requests to attacker-controlled URLs via requests/urllib without any allowlist, scheme restriction, or destination validation. In a skill whose stated purpose is geospatial format conversion, this expands the attack surface and can enable SSRF-style access to internal services or unapproved network egress if higher-level inputs are user-controlled.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file exposes place-resolution behavior and delegates to geocoding logic that is unrelated to the declared purpose of a batch raster/vector format converter. In a skill ecosystem, this kind of capability mismatch is dangerous because it expands the trust boundary and can cause user-provided location terms to be sent to external services unexpectedly.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code performs outbound HTTP requests to Open-Meteo and Nominatim using user-supplied place queries, even though the skill is described as a local GDAL/OGR format conversion tool. This creates an undeclared data egress path and increases supply-chain risk because sensitive or proprietary location names may be transmitted to third parties without user expectation.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring frames the file as a harmless compatibility shim, but the fallback path retains substantial network-enabled geocoding logic. That discrepancy can mislead reviewers and operators, making it easier for unexpected network behavior to remain deployed and trusted under the appearance of a simple adapter.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Place names are transmitted to external geocoding providers without any visible user-facing warning in this module. In the context of a skill advertised for local batch geospatial format conversion, this is dangerous because users may unknowingly disclose sensitive operational locations or project context to third parties.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The module persists resolved place data in a cache under the user's home directory without any user-facing notice or retention control. This can leave sensitive location history on disk and expose it to other local users, backup systems, or later compromise, especially when users expect a transient conversion utility.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module hardcodes fallback credentials, including an Earthdata username and password, directly in source code. Hardcoded credentials are highly dangerous because anyone with repository or package access can recover and reuse them, and the fallback behavior may silently authenticate to external services without explicit user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
User-supplied place strings are transmitted to third-party geocoding services without any visible warning or consent mechanism in this file. This can leak sensitive project names, locations, or internal site references, especially in enterprise or regulated GIS workflows where place names may themselves be confidential.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The Nominatim request hard-codes a Chinese language preference, which is not justified by the skill’s stated purpose and is applied without user choice. While not a direct code-execution issue, it creates unnecessary privacy and policy concerns, may bias results, and signals hidden behavioral assumptions in a tool that should be predictable and narrowly scoped.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
95% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
95% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
95% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
93% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
96% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
96% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
95% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
99% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15