ClawHub
Back to skill

Security audit

geoskill-instance-segmentation

Security checks across malware telemetry and agentic risk

Overview

The main segmentation command appears locally scoped, but the package ships unrelated network, downloader, caching, and credential-reading code that is not disclosed to users.

Treat this as a Review install: only use it if you are comfortable with the extra bundled code, or remove/disable the geocoding, downloader, cache, and credential modules before installation. The main CLI looks like a local segmentation script, but the package as shipped has broader authority than the docs disclose.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares itself as offline and lists no permissions, yet the detected capabilities include file access, shell execution, environment access, and network use. This creates an unsafe trust boundary: operators may approve or run the skill under the assumption that it is low-risk, while it may access local data, secrets, or external endpoints beyond what the manifest suggests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a significant description-behavior mismatch: the skill is presented as a local offline numpy-equivalent segmentation tool, but the detected behavior includes online AOI/geocoding requests, caching, credential loading from environment and user files, and even hardcoded default credentials. That combination can lead to secret exposure, unexpected outbound network access, and misleading users into executing a much more privileged workflow than they consented to.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the advertised offline instance-segmentation skill. This provenance mismatch undermines supply-chain integrity and makes it plausible that unrelated code was copied in, swapped, or mislabeled, which can conceal unexpected functionality and defeat reviewer trust.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The vendored file list includes safe_download.py and credentials.py even though the skill is described as an offline NumPy-equivalent segmentation tool. Unnecessary download and credential-handling components expand the attack surface, create opportunities for secret misuse or hidden network behavior, and are especially suspicious when paired with mismatched provenance metadata.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file implements AOI geocoding with online fallbacks and caching, which is materially unrelated to the skill’s declared offline instance-segmentation purpose. This kind of capability mismatch is dangerous because it expands the trust boundary and can conceal unexpected data flows or behavior users would not anticipate from an offline image-processing skill.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The module imports HTTP client functionality and later performs requests to external geocoding services, contradicting the claimed offline-only segmentation behavior. In a supposedly offline skill, undisclosed outbound requests can leak user-supplied locations or derived workflow context to third parties and violate user expectations or platform policy.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code persists cache data under the user’s home directory, creating undeclared local state for query results. Even if the cached content is not highly sensitive by itself, persistent storage can expose user inputs, operational history, or geocoding results across sessions in a skill that claims offline segmentation and does not justify filesystem side effects.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module introduces broad credential-management and external service authentication capabilities that are unrelated to the stated offline instance-segmentation purpose of the skill. In a skill that claims to be local/offline numpy-equivalent processing, code that can collect credentials for multiple services materially expands attack surface and creates a path for secret harvesting or later exfiltration.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code reads secrets from environment variables, ~/.geoskill/secrets.json, and ~/.netrc, giving the skill the ability to access sensitive credentials from the host environment. In the context of an offline image-segmentation skill, this behavior is unnecessary and dangerous because it enables secret collection from locations users may not expect the skill to touch.

Context-Inappropriate Capability

High
Confidence
92% confidence
Finding
This code implements a generic remote HTTP downloader with streaming, custom headers, timeout handling, retries, and range resume support, which is functionality unrelated to the stated offline instance-segmentation purpose. In an allegedly offline skill, bundled download capability materially expands the attack surface by enabling unexpected network access and delivery of arbitrary remote content into later processing stages.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill can download attacker-controlled content and write it to disk via user-supplied URLs and filenames, despite the manifest describing an offline numpy-equivalent segmentation implementation. This mismatch is dangerous because users and orchestrators may grant the skill more trust than warranted, while the downloader enables hidden network egress, local file creation, and potential chaining into downstream parsing or model-loading behavior.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements place-name geocoding with optional online resolution, which materially contradicts the declared skill purpose of offline instance segmentation. In an agent setting, hidden or unrelated capabilities expand the attack surface, can trigger unintended network egress, and may cause users or orchestrators to trust a skill with behavior outside its advertised scope.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code performs external HTTP requests to Open-Meteo and Nominatim even though the skill is described as an offline numpy-equivalent segmentation tool. Undeclared network access can leak user inputs, environment-derived context, or workflow metadata to third parties and bypass operator expectations for isolated/offline processing.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The module header openly states that this file is a compatibility shim for AOI/place resolution, which is inconsistent with the published skill purpose. This kind of capability mismatch is dangerous because reviewers, users, and automated policy systems may permit the skill under false assumptions, enabling hidden functionality to execute in a more trusted context.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
Forcing the Accept-Language header to zh-CN without user choice introduces an undeclared request characteristic that can affect privacy, localization, and result handling. In the context of a skill advertised as offline segmentation, any silent request tailoring to an external service is more concerning because it is unrelated to the claimed function and increases hidden behavior.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module hardcodes fallback credentials, including a plaintext EARTHDATA username and password, directly in source code. Hardcoded secrets are immediately exposed to anyone with repository or package access and may enable unauthorized access, credential reuse attacks, or downstream compromise if reused elsewhere.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
Forcing the Accept-Language header to Chinese without user opt-in overrides user or system locale preferences and sends an unnecessary preference signal to a third-party service. In a mis-scoped skill already making undeclared network calls, this increases privacy concerns and can alter results in ways that are opaque to users.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
92% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
92% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
91% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
91% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
91% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
98% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15