ClawHub
Back to skill

Security audit

geoskill-multi-hazard-risk-assessment

Security checks across malware telemetry and agentic risk

Overview

The main risk calculator appears local, but the package also includes under-disclosed network, download, and credential-handling code that does not fit the stated offline purpose.

Review this skill before installing. The advertised CLI appears to do local raster risk calculations, but the package also ships broader helper modules for online geocoding, downloads, local credential/profile reads, and embedded Earthdata fallback credentials. Install only if you trust and need the full package, or remove/audit the unused helper modules and pin dependencies first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a significant description-behavior mismatch: the skill is presented as a narrow offline multi-hazard risk calculator, but the finding indicates broader functionality including network geocoding, HTTP downloads, credential loading from environment/.netrc/secrets, and returning external-service credential interfaces. That mismatch can mislead users into granting trust to a data-processing skill that may access secrets or external services outside the expected scope, increasing the risk of credential exposure, unauthorized network access, and hidden data flows.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The vendored metadata shows inclusion of a different skill, 'landsat-download', inside a package described as multi-hazard risk assessment and zoning. That capability mismatch is a real supply-chain/integrity concern because it can hide unexpected network-facing or data-access behavior that reviewers would not anticipate from the declared purpose.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Including safe_download.py and credentials.py introduces data retrieval and secret-handling functionality that is not evidently needed for a pure risk-index computation skill. In this context, unexpected download and credential code increases the attack surface for unauthorized network access, secret misuse, or covert data exfiltration, making the package more dangerous than its stated purpose suggests.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This module hardcodes a default Earthdata username and password in source code, creating embedded reusable credentials that any code path can silently consume. Hardcoded secrets are dangerous because they can be extracted from the repository, reused outside intended contexts, and may grant unauthorized access long after deployment.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code transmits user-provided place queries to third-party geocoding services and stores derived results locally, but this file contains no consent, disclosure, or privacy guardrails. In a risk-assessment skill, queried locations may be sensitive operational or personal information, so sending them to external providers can leak user intent, location interest, or proprietary project areas.

Missing User Warnings

High
Confidence
98% confidence
Finding
Hardcoded fallback credentials without strong disclosure or consent enable the skill to access external services under a bundled account even when the user did not provide credentials. In this context, that is especially risky because the skill is for analytical geospatial processing and does not need to conceal credentialed access behind defaults.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends raw user-supplied place queries to third-party geocoding services without any notice, consent flow, or minimization in this file. Even if the input is 'just a place name,' queries can contain sensitive locations, internal project sites, or personally revealing address data, creating a privacy and data-governance risk.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
Forcing the Accept-Language header to prefer Chinese without user opt-in can leak localization assumptions and produce provider-side processing that does not match user expectations or policy requirements. This is mainly a privacy/UX and compliance concern rather than a severe exploit path, but it is still undesirable because it overrides user choice silently.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
99% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
93% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15