ClawHub
Back to skill

Security audit

geoskill-hyperspectral-vegetation-stress

Security checks across malware telemetry and agentic risk

Overview

The main vegetation analysis appears local, but the package also contains undisclosed credential, geocoding, download, and persistent-cache helpers.

Review this package before installing. The core CLI appears to perform local raster analysis, but the bundled helper code should be cleaned up or scoped: remove embedded credentials, disclose or disable remote geocoding and location caching, and pin dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
76% confidence
Finding
The skill declares no permissions, yet the detected capabilities include network, shell, file access, and environment access. This is dangerous because users and orchestrators cannot accurately assess the skill’s operational reach, and hidden capabilities can enable unintended data access, command execution, or external communications beyond the stated offline geospatial purpose.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented purpose is narrow hyperspectral vegetation-stress analysis, but the skill reportedly also includes geocoding, external network access, a generic downloader, registry/conversion utilities, and credential-handling logic including reading secrets and embedded default Earthdata credentials. This mismatch is dangerous because it conceals sensitive behaviors from users, expands the attack surface significantly, and introduces credential exposure and unauthorized network interaction unrelated to the advertised task.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The vendored core metadata identifies the skill as 'landsat-download' while the package is presented as a hyperspectral vegetation-stress skill. This kind of identity mismatch can indicate a packaging or supply-chain integrity problem, causing reviewers or automated tooling to validate the wrong component and potentially trust unexpected vendored code.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The AOI helper sends user-supplied place names to external geocoding services and also persists results locally, which exceeds the narrowly described hyperspectral vegetation-stress analysis behavior. This creates a real privacy and data-boundary issue because location queries may contain sensitive operational sites, farms, or infrastructure and are disclosed to third parties and to disk without an explicit trust boundary in this component.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The module claims it does not cache passwords, but `load_user_secrets()` writes secrets into the process-global `_DEFAULTS` map and keeps them resident for the lifetime of the process. This mismatch can mislead users and developers about credential exposure in long-lived agent processes, increasing the chance of secret disclosure through memory inspection, debug tooling, or unintended reuse.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The module makes outbound HTTP requests to third-party geocoding services using user-supplied place strings. In a skill whose stated purpose is hyperspectral vegetation-stress analysis, this creates unnecessary data egress and expands the attack surface through external dependencies, potentially leaking sensitive locations or enabling unexpected network behavior in restricted environments.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Location queries are transmitted to Open-Meteo and potentially Nominatim with no visible user-facing warning or consent mechanism in this code path. In a geospatial skill, AOIs can reveal sensitive business locations or research targets, so silent third-party disclosure is a legitimate privacy/security issue.

Missing User Warnings

Low
Confidence
88% confidence
Finding
Resolved place data is written to a persistent cache under the user's home directory without prominent disclosure or explicit consent. Even though the cached data is limited, it can still reveal sensitive queried locations over time to other local users, backups, or forensic review.

Missing User Warnings

High
Confidence
99% confidence
Finding
The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Embedding real or usable credentials in source code is a serious secret-management failure: anyone with repository or package access can recover them, and downstream users may unknowingly authenticate with shared credentials, enabling account compromise, abuse, and attribution confusion.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
82% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15