ClawHub
Back to skill

Security audit

geoskill-frost-risk-mapping

Security checks across malware telemetry and agentic risk

Overview

The main frost-mapping tool is mostly local and purpose-aligned, but the package also ships under-disclosed network and credential helpers, including a hardcoded Earthdata username/password.

Review this skill before installing. The frost-mapping entrypoint itself appears local, but the package should remove the hardcoded Earthdata credentials, disclose or remove unused network/credential helper modules, fix vendored provenance, and pin dependencies before being treated as low-risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a serious description-behavior mismatch: the skill presents itself as a fully offline frost-mapping tool, but the detected behavior includes geocoding, remote downloads, unrelated service integrations, and credential handling for multiple external providers, including a hardcoded fallback username/password. That combination can lead to covert data exfiltration, unexpected network access, credential leakage, and supply-chain risk well outside the user's reasonable expectations for this skill.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The vendored metadata claims the embedded core was sourced for a different skill ('landsat-download') than the current frost-risk-mapping skill. This is a supply-chain integrity issue because provenance records no longer reliably describe what code is embedded, making review, patch tracking, and trust decisions error-prone; in the worst case, unrelated or substituted components could be shipped unnoticed.

Intent-Code Divergence

Critical
Confidence
99% confidence
Finding
The documentation claims passwords are not hardcoded, yet the module embeds fallback Earthdata credentials directly in `_DEFAULTS`. Hardcoded credentials in source control can be harvested by anyone with code access and reused for unauthorized access, and the misleading comment increases the risk that reviewers overlook the exposure.

Missing User Warnings

High
Confidence
99% confidence
Finding
The `_DEFAULTS` dictionary contains a real-looking username and password that are automatically used when no external secret is configured. This creates a built-in credential backstop that can silently enable unauthorized service access and leaks sensitive material to every downstream consumer of the repository.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
93% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
89% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15