ClawHub
Back to skill

Security audit

geoskill-map-layout-automation

Security checks across malware telemetry and agentic risk

Overview

The main command renders maps locally, but the package also includes undisclosed network, download, credential, and home-directory persistence capabilities that do not fit its advertised offline layout purpose.

Review this before installing. The primary map-layout command appears to render local rasters, but the package also ships helper capabilities for third-party geocoding, arbitrary downloads, and credential discovery, including hardcoded fallback credentials. Install only if you trust the publisher and are comfortable removing or isolating those helper modules, and avoid running it in an environment with sensitive ~/.netrc or ~/.geoskill/secrets.json entries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (44)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
A map-layout skill that claims offline local cartographic rendering but whose associated behavior reportedly includes geocoding, remote downloads, credential handling, and even hardcoded fallback credentials is a serious trust-boundary violation. This mismatch can conceal data exfiltration, unauthorized network access, or secret misuse behind an innocuous description, making the skill substantially more dangerous because users would reasonably expect no networked or credentialed operations.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the advertised map-layout automation skill. This is a supply-chain integrity problem because reviewers and users cannot reliably determine what code was vendored, and mismatched provenance can hide accidental inclusion of unrelated functionality or intentional code substitution.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This helper expands a map-layout skill into place-resolution behavior that sends user-supplied place names to external services and persists results locally. In a layout automation context, undisclosed network access and home-directory caching create unnecessary data exposure and broaden the trust boundary beyond what users would reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code transmits place queries to Open-Meteo and Nominatim, which can disclose sensitive user intent, locations, or project data to third parties. For a skill advertised as map layout automation, this is a meaningful scope expansion and privacy risk, especially because the behavior is automatic fallback rather than explicit user choice.

Context-Inappropriate Capability

Low
Confidence
86% confidence
Finding
Writing geocoding cache files into the user's home directory creates persistent local storage of potentially sensitive place queries and resolved areas. Although lower severity than outbound exfiltration, it can leak project intent to other local users, backups, or forensic review without clear disclosure.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This module gives the skill broad capability to discover and return multiple unrelated credentials from environment variables, ~/.netrc, and ~/.geoskill/secrets.json. For a map layout automation skill, that scope is unjustified and materially increases the blast radius: any downstream code in the skill can access OpenAI, Earthdata, CMA, FIRMS, and EOG secrets even though the advertised function is local layout rendering.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code contains hardcoded fallback credentials for EARTHDATA_USERNAME and EARTHDATA_PASSWORD directly in source. Hardcoded credentials are inherently dangerous because they can be extracted from the repository, reused by anyone with code access, and may enable unauthorized access or account compromise if they are real.

Description-Behavior Mismatch

High
Confidence
88% confidence
Finding
This file implements a full-featured remote downloader with retries, resume support, arbitrary destination paths, and optional hash verification, which materially exceeds the stated purpose of a map-layout export skill. In this context, the capability enables the skill to fetch untrusted remote content into the local filesystem and can be repurposed for payload staging, data import from attacker-controlled endpoints, or policy circumvention even if no immediate exploit is shown in this file alone.

Context-Inappropriate Capability

High
Confidence
91% confidence
Finding
The exported API provides unjustified general-purpose network transfer for a skill whose description is limited to automating map layout elements and exporting PDF/PNG. Such excess capability increases attack surface because any component that can invoke this helper may download arbitrary files, and the current controls are insufficient to prevent misuse: hash checks are optional, URLs are unrestricted, and destination paths are caller-controlled.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The public API exposes place resolution parameters and delegates to code paths that can perform external geocoding, which is a capability beyond the stated map-layout automation purpose. This expands the skill's data exposure surface by sending user-supplied place names to third-party services, creating privacy and scope-creep risk even if the behavior is not overtly malicious.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The legacy implementation makes outbound requests to Open-Meteo and Nominatim using user-provided queries, introducing undeclared third-party communications into a skill described only as map-layout automation. In this context, the unjustified network capability is dangerous because it can leak potentially sensitive location inputs and makes the skill do more than users would reasonably expect.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Place queries are sent to third-party geocoding services without any warning in this file, so users may unknowingly disclose sensitive location terms. In the context of a map-layout skill, silent transmission is more concerning because users may assume processing is local and formatting-only.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Caching resolved place data to a file in the home directory without disclosure silently persists potentially sensitive user inputs and derived AOI data. This can create privacy and retention issues that outlive the task and are not expected from simple layout automation.

Missing User Warnings

High
Confidence
99% confidence
Finding
Hardcoded fallback credentials are present without any warning, prompting, or disclosure to users. This makes silent use of embedded credentials possible and hides the fact that the skill may authenticate to third-party services using secrets bundled in code.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The module automatically reads a sensitive user secrets file from the home directory and merges values into defaults without any operation-local disclosure or consent. In the context of a map layout skill, silent access to a broad personal secret store is unnecessary and increases the risk of unexpected credential use by other code paths.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The code transmits raw user place queries to external geocoding providers without any user-facing notice, consent flow, or in-file disclosure. While this is primarily a privacy and transparency issue rather than direct code execution, it is still unsafe because place names can reveal sensitive interests, travel, operations, or customer locations.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
Forcing the Accept-Language header to Chinese without user choice or documented need silently alters how a third party processes the request and can influence returned results in unexpected ways. In a map-layout skill, this unnecessary hardcoding increases surprise, reduces transparency, and may bias or misroute geocoding outcomes for users outside that locale.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
87% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
86% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
89% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
89% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
89% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
95% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15