ClawHub
Back to skill

Security audit

geoskill-hyperspectral-classification

Security checks across malware telemetry and agentic risk

Overview

The main skill appears to perform local hyperspectral classification, but the package also ships undisclosed geocoding, download, caching, and credential-handling code that does not fit the stated offline purpose.

Install only after the publisher removes or clearly documents the unrelated geocoding, downloader, cache, and credential modules. The main classifier itself appears local, but the shipped package has extra sensitive capabilities and a hardcoded credential fallback that should be treated as a security hygiene issue.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions, yet the analyzed capability set includes environment access, file read/write, shell, and network. This under-disclosure is dangerous because users may execute the skill believing it is offline and self-contained, while the implementation could access secrets, local files, or external services without informed consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is local PCA+RF/SVM hyperspectral classification, but the analyzed behavior includes network access, credential handling, generic downloading, and even hardcoded Earthdata credentials. That mismatch is high risk because it can conceal unnecessary data exfiltration, secret harvesting, or abuse of bundled credentials under the cover of a benign geospatial processing skill.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The vendored metadata shows the bundled core component is for 'landsat-download', which does not match the declared hyperspectral PCA/RF/SVM classification purpose. This kind of capability/purpose mismatch is a supply-chain transparency issue because it can hide unexpected functionality, expand the attack surface, and undermine trust in what the skill is actually shipping.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The presence of safe_download.py and credentials.py indicates the package includes network access and credential-handling capabilities not obviously needed for a local hyperspectral classification workflow. Unnecessary download and secret-handling code increases the risk of data exfiltration, unauthorized external access, or future abuse if these components are reachable by the agent runtime.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), creating outbound network behavior that is unrelated to the stated hyperspectral PCA/RF/SVM classification purpose. In this skill context, hidden external requests expand the attack surface, leak potentially sensitive AOI queries, and violate least functionality expectations for an offline/local analysis workflow.

Context-Inappropriate Capability

High
Confidence
90% confidence
Finding
The code embeds context-inappropriate geocoding capability in a hyperspectral classification skill, which means the skill can unexpectedly contact third-party services and process user location queries. Even if not overtly malicious, this mismatch is dangerous because users reasonably expect a classification tool, not a networked location-resolution component with data egress.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The module persistently stores resolved queries under the user's home directory, including user-provided place strings and derived AOI data, without any evident need tied to hyperspectral classification. In this context, undeclared persistent storage can expose sensitive location interests across sessions and leaves data residue on disk.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module centralizes access to multiple unrelated third-party credentials in a skill advertised for hyperspectral PCA/RF/SVM classification, which materially expands the attack surface and violates least-privilege expectations. In context, the mismatch between declared purpose and broad credential plumbing increases suspicion because the skill can reach user secrets and service accounts unrelated to its stated function.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code reads user-level secrets and environment credentials for multiple services via ~/.geoskill/secrets.json, environment variables, and .netrc, despite no clear relationship to hyperspectral classification. Even without immediate exfiltration in this file, unauthorized credential collection capability is dangerous because it enables downstream misuse by other parts of the skill or future changes.

Intent-Code Divergence

Critical
Confidence
100% confidence
Finding
The documentation states passwords are not hardcoded in skill source, but _DEFAULTS embeds a real-looking Earthdata username and password fallback directly in code. Hardcoded credentials are immediately extractable by anyone with source access and may enable unauthorized account access, while the contradictory documentation suggests concealment or poor security hygiene.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file implements a reusable arbitrary-URL downloader that is much broader than the skill’s stated purpose of hyperspectral PCA/RF/SVM classification. Even though the implementation includes safety features like retries, temp files, and optional hash checks, it still expands the skill’s capability to fetch remote content from unbounded external sources, increasing attack surface and enabling supply-chain or data exfiltration workflows if invoked by other components.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The helper accepts arbitrary URLs and performs outbound HTTP requests without domain restriction, which is inconsistent with a classification-only skill and creates a broad network primitive. In practice, this can be abused to retrieve untrusted payloads, contact attacker-controlled infrastructure, or bypass intended offline/local-only expectations, especially because integrity checking is optional rather than mandatory.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The file’s behavior materially diverges from the declared skill purpose: instead of hyperspectral PCA/RF/SVM classification logic, it resolves place names and performs AOI/geocoding delegation. In a skill ecosystem, this kind of capability mismatch is dangerous because it can conceal unexpected data flows and network-enabled behavior that reviewers and users would not reasonably expect from the manifest.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code makes outbound requests to Open-Meteo and Nominatim, sending user-supplied place queries to third parties. Because the skill is presented as hyperspectral classification rather than geocoding, these network calls create an undisclosed exfiltration and tracking surface, especially dangerous in agent environments where location names may derive from sensitive user context or internal workflows.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
User-entered place names are transmitted to third-party geocoding services without any disclosure in this file, which creates a privacy and data-governance issue. In a hyperspectral classification skill, that undisclosed egress is more suspicious because users would not naturally expect their AOI queries to leave the local environment.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code writes resolved place queries and AOI manifests to persistent cache files in the user's home directory without user-facing notice. This can expose sensitive geographic interests to other local users, backup systems, or later forensic review, especially when the skill's advertised purpose does not imply such storage.

Missing User Warnings

High
Confidence
99% confidence
Finding
The fallback Earthdata credentials are embedded in code and can be silently used when the environment is unset, allowing hidden account use without user awareness. This creates risk of unauthorized access, credential leakage via repository distribution, and abuse of the referenced external account.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
90% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
88% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
90% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
95% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15