ClawHub
Back to skill

Security audit

geoskill-irrigation-efficiency

Security checks across malware telemetry and agentic risk

Overview

The main irrigation tool is local, but the package bundles undisclosed credential, network, and cache helpers including a plaintext Earthdata password.

Review before installing. The main command appears to process local raster or synthetic data, but the package also ships unused or auxiliary code that can access local credentials, use a hardcoded Earthdata account, call external geocoding services, and write a home-directory cache. Install only in an environment where those capabilities are acceptable, and avoid exposing personal API keys or .netrc secrets to this skill until the publisher removes or scopes the extra helpers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
77% confidence
Finding
The skill metadata claims offline/local processing and declares no permissions, yet the detected capabilities include network, shell, environment access, and file read/write. This mismatch weakens user consent and sandbox expectations, because a caller may run the skill believing it has only local geospatial functionality while it can access broader system and network resources.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is irrigation-efficiency analysis, but the detected behavior includes geocoding/network requests, generic download logic, credential management, and hardcoded NASA Earthdata credentials. Hidden credentialed network functionality is especially dangerous because it expands the attack surface beyond the stated task and could enable unauthorized data access, secret leakage, or abuse of embedded accounts.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The module sends user-supplied place names to external geocoding services, which can disclose potentially sensitive locations and create an unadvertised network egress path. In a skill framed as irrigation-efficiency analysis, this is a meaningful privacy and data-handling risk because user AOIs may reveal farms, assets, or operational interests.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The code persists queried place names and resolved AOIs to a cache directory in the user's home folder, which can leave a local record of potentially sensitive geographic interests. This is not severe by itself, but it creates avoidable privacy exposure and data retention without visible user consent in this file.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This module centralizes access to multiple unrelated third-party credentials, including OpenAI, FIRMS, CMA, and EOG, even though the declared skill purpose is irrigation-efficiency analysis. Broad credential-access capability increases the attack surface and enables credential harvesting or later misuse if any downstream code in the skill invokes these helpers unnecessarily.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Supporting retrieval of an OPENAI API key is not justified by the stated irrigation calculation workflow and creates unnecessary access to sensitive credentials. Even without exfiltration code in this file, exposing a helper that can read unrelated secrets makes later abuse by other components much easier.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module exposes credential access for FIRMS and EOG services that are outside the core irrigation-efficiency purpose described for the skill. Unnecessary secret-access pathways violate least-privilege and expand the number of external accounts that could be abused if this skill or shared core code is compromised.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The fallback implementation sends user-provided place queries to third-party geocoding services, which can disclose potentially sensitive user intent or location data outside the local environment. In this skill context, geocoding is plausibly needed to derive an AOI, but the undisclosed outbound network behavior and data sharing with external providers create a real privacy and supply-chain exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Place queries are transmitted to third-party geocoding endpoints without any user-facing disclosure in this module, which is a privacy and transparency issue. For agricultural analysis, AOI queries may correspond to real land parcels or business-sensitive sites, making undisclosed data sharing more dangerous in context.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The module caches place queries and derived manifests to disk under the user's home directory without visible disclosure, creating silent persistence of potentially sensitive location data. This can expose user intent and operational geography to other local users, backups, or forensic review, especially on shared systems.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Embedded credentials in source are dangerous because anyone with repository or package access can reuse them, and they also normalize unsafe secret-handling practices that can lead to unauthorized external service access.

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
87% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True
Confidence
86% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
95% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
82% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
84% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15