ClawHub
Back to skill

Security audit

geoskill-lulc-accuracy-assessment

Security checks across malware telemetry and agentic risk

Overview

The main accuracy-assessment tool is local and coherent, but the package ships under-disclosed network, download, and credential helpers including embedded Earthdata credentials.

Review this package before installing in sensitive environments. The visible CLI appears to process local raster data, but the distribution includes unrelated network and credential helpers, a provenance mismatch in vendored metadata, and embedded Earthdata credentials. Prefer a minimized build that removes unused geocoding, download, and credential modules and pins dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions, yet the documented and detected capabilities include shell, file read/write, environment access, and network access. This mismatch prevents informed consent and makes it easier for a seemingly simple offline accuracy-assessment skill to perform broader actions than users would reasonably expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is narrow—LULC accuracy assessment—but the detected behavior includes geocoding, external HTTP access, file downloading, credential handling, and broader remote-sensing registry/utilities. This kind of overbroad functionality materially increases attack surface and creates a risk of undisclosed data egress, credential exposure, or unexpected actions under the cover of a benign geospatial analysis skill.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The vendored metadata declares the skill as 'landsat-download' while the package is presented as a LULC accuracy-assessment skill, which indicates a provenance/integrity mismatch. Even though this file is only metadata, such inconsistencies can hide code reuse from an unrelated skill, break reviewer trust, and mask unintended or unauthorized capabilities shipped under the wrong identity.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The vendored file list includes download- and credential-oriented modules such as safe_download.py and credentials.py, which are not obviously required for a local raster accuracy-assessment skill. In this context, unrelated bundled capabilities expand the attack surface and create room for hidden network access, credential handling, or future abuse if these modules are imported or invoked implicitly.

Context-Inappropriate Capability

High
Confidence
87% confidence
Finding
The code sends user-supplied place queries to external geocoding services (Open-Meteo and optionally Nominatim), which creates an unexpected data egress path in a skill described as LULC accuracy assessment. This can leak sensitive project locations, study areas, or user inputs to third parties, and the mismatch with the skill's declared purpose makes the behavior more surprising and therefore riskier.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
This credential module exposes access paths for multiple unrelated external services (OpenAI, CMA, EOG, FIRMS, Earthdata) that are not justified by the stated land-cover accuracy-assessment skill purpose. Expanding credential-handling scope increases attack surface and creates unnecessary capability for remote access or later abuse, especially in a skill that should be narrowly scoped.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code hardcodes fallback Earthdata credentials directly in source (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`). Hardcoded credentials are secrets exposure by design: anyone with source access can recover them, reuse them for unauthorized remote-service access, and they may also unintentionally work in production when environment configuration is absent.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The module documentation explicitly claims passwords are not hardcoded in source, yet the implementation embeds fallback credentials. This mismatch is dangerous because reviewers and operators may trust the documentation, overlook the real exposure, and deploy code containing live secrets.

Context-Inappropriate Capability

High
Confidence
88% confidence
Finding
The code sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which is not obviously required by the stated LULC accuracy-assessment purpose. In this skill context, undisclosed outbound transmission of user input increases privacy and supply-chain risk, especially if users assume the skill operates locally on raster/reference data.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Place queries are transmitted to external services without any visible disclosure, consent mechanism, or privacy warning in the code path. In geospatial workflows, place names and AOIs can reveal sensitive operational, commercial, or personal context, so undisclosed transmission is a real privacy/security concern.

Missing User Warnings

High
Confidence
99% confidence
Finding
The fallback credentials are embedded silently with no runtime disclosure, warning, or forced opt-in. Hidden credentialed behavior makes accidental unauthorized access more likely and prevents users from understanding that the software may authenticate to a third-party service using bundled secrets.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
User-provided place queries are transmitted to third-party services without any explicit notice in this file, creating a privacy issue because potentially sensitive locations may be disclosed externally. In a geospatial workflow, place names can reveal project sites, operational areas, or confidential study regions even when the rest of the data remains local.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
93% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
93% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
94% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
94% confidence
Finding
scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
78% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
80% confidence
Finding
scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15