ClawHub
Back to skill

Security audit

geoskill-lulc-future-prediction

Security checks across malware telemetry and agentic risk

Overview

The main land-cover predictor is local, but the package bundles unrelated credential, downloader, and online geocoding code, including a hardcoded Earthdata password.

Install only after reviewing or removing the unrelated vendored modules, especially credentials.py, safe_download.py, _place.py, and _geoskill_core/aoi.py. The exposed Earthdata credential should be revoked or rotated, and dependencies should be pinned or locked before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises shell, file, environment, and network-capable usage but declares no permissions, which creates a transparency and least-privilege failure. In an agent setting, this can cause the skill to receive broader execution capabilities than users expect, increasing the chance of unintended file access, secret exposure, or outbound connections.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared purpose is local LULC prediction, but the detected behavior includes networked AOI resolution, generic downloading, credential harvesting paths (.netrc, env, secrets files), and even a hardcoded Earthdata credential fallback. This is a serious description-behavior mismatch that can mislead users into granting trust to a geospatial analysis tool that also performs credential access and remote data retrieval far outside its stated scope.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The vendored metadata declares a different embedded skill, 'landsat-download', instead of one aligned with the advertised CA-Markov land-cover prediction purpose. This supply-chain and integrity mismatch is dangerous because it can hide undeclared capabilities, mislead reviewers about what code is actually present, and enable unexpected data access or network behavior through the bundled core files.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The metadata references modules such as safe_download.py and credentials.py, indicating download and credential-handling functionality that is not clearly justified by a forecasting-only skill. In this context, undeclared network and secret-management capabilities expand the attack surface, creating risk of unauthorized data retrieval, credential misuse, or hidden exfiltration paths if those bundled components are invoked.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The module documentation explicitly claims passwords are not hardcoded, yet `_DEFAULTS` contains a real Earthdata username and password. Hardcoded credentials can be harvested by anyone with source access and may enable unauthorized access, while the misleading documentation increases the chance reviewers miss the exposure.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
The `safe_download` and `safe_download_many` functions provide reusable arbitrary-URL download capability with caller-controlled destination filenames, which can expand the skill beyond its stated modeling purpose and enable retrieval of untrusted content. Although the code includes integrity and size-check options, they are optional, and there is no allowlist of domains, scheme restriction, or mandatory digest verification, so downstream callers could use this helper to fetch attacker-controlled payloads or unexpected large data.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file implements generalized place-resolution and external geocoding logic that is broader than the stated land-cover prediction purpose, creating capability drift between the manifest and actual behavior. In an agent-skill setting, hidden or under-declared network-enabled functionality increases the attack surface, can surprise users/operators, and may enable unintended outbound data disclosure of user-supplied locations.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code sends user-provided place queries to third-party services (Open-Meteo and Nominatim) over the network, which can leak sensitive location intent and create unbounded external dependencies not justified by the stated skill description. Even though the destinations are hardcoded and there is no obvious SSRF, this is still risky in agent environments because it enables silent exfiltration of user input and introduces availability/privacy concerns.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The docstring suggests a unified delegation path, but the implementation silently falls back to a legacy network-capable resolver when the core module is unavailable or fails. This discrepancy can defeat operator expectations and security review assumptions, causing undeclared network behavior in environments that believed only the core path would run.

Credential Access

High
Category
Privilege Escalation
Content
解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")
Confidence
97% confidence
Finding
.netrc

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
96% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
97% confidence
Finding
scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical
Category
Supply Chain
Confidence
93% confidence
Finding
scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15