ClawHub
Back to skill

Security audit

geoskill-multimodal-fusion-ai

Security checks across malware telemetry and agentic risk

Overview

The advertised offline raster-fusion tool ships extra network, download, credential, and home-directory persistence helpers that are not disclosed or scoped to the stated purpose.

Review before installing. The main fusion script looks like a local raster-processing CLI, but the package also includes unused or auxiliary modules that can contact third-party geocoding services, download arbitrary URLs, read local credential stores, and persist location lookups in the user home directory. Install only if you are comfortable with those bundled capabilities or can remove/disable them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill claims to operate offline and declares no permissions, yet static analysis detected capabilities for environment access, file read/write, network, and shell. That mismatch is dangerous because users may run the skill with higher trust than warranted, enabling unintended local data access, credential exposure, file modification, or outbound communication.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a substantial description-behavior mismatch: the skill is presented as an offline NumPy-equivalent raster fusion tool, but analysis indicates geocoding requests, arbitrary URL downloads, caching under the user home directory, credential harvesting from env/.netrc/secrets files, and even hardcoded fallback credentials. In this context, the hidden network, secret access, and download features materially expand the attack surface and could lead to exfiltration, unauthorized remote access, or execution of untrusted content under the guise of benign geospatial processing.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file performs external geocoding requests to Open-Meteo and Nominatim using user-supplied place strings, which contradicts the stated offline raster-fusion purpose of the skill. In this context, undisclosed network egress expands the trust boundary, can leak sensitive location queries, and introduces remote dependency behavior that users would not expect from an offline processing skill.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code adds broad external geocoding capability that is not justified by a multimodal raster standardization/fusion/classification skill. Because the skill description emphasizes offline NumPy-equivalent processing, this extra capability is risky: it can exfiltrate user input, create hidden operational dependencies, and provide functionality outside the expected least-privilege scope.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The module persists cached AOI resolution results under the user's home directory without clear necessity for the advertised offline raster-fusion use case. Persistent storage of location-derived data can expose sensitive places across sessions, surprise users, and leave artifacts on shared or managed systems.

Description-Behavior Mismatch

High
Confidence
90% confidence
Finding
This module materially expands the skill’s capability from an advertised offline raster-fusion tool into one that can access multiple external services and local credential stores. That mismatch increases attack surface and creates unnecessary access paths to sensitive data, especially in an agent/skill environment where users may grant trust based on the stated offline-only purpose.

Context-Inappropriate Capability

High
Confidence
88% confidence
Finding
Support for reading OPENAI_API_KEY is unrelated to the declared offline geospatial fusion function and enables access to a high-value secret without demonstrated need in this file. In a hostile or overprivileged skill ecosystem, unnecessary secret access is dangerous because it can facilitate downstream exfiltration or unauthorized API usage.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code is designed to resolve credentials for several remote services despite the skill being described as an offline NumPy-equivalent implementation. Broad credential support is not a vulnerability by itself, but in this context it is an unjustified privilege expansion that increases the chance of secret collection and misuse.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The skill is described as an offline raster fusion/classification tool, but this file introduces a generic HTTP downloader that can fetch arbitrary remote content and write it locally. That capability materially expands the trust and attack surface beyond the declared purpose, enabling covert data ingress, supply-chain exposure, and policy bypass in environments that would otherwise expect offline-only behavior.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
This module provides reusable generic network download functionality with arbitrary URL input and local file write capability, which is unjustified for an offline fusion skill. In context, that mismatch is dangerous because it creates hidden network behavior that can be repurposed to fetch untrusted payloads, stage files on disk, or undermine operator assumptions about isolation.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file adds place-resolution and live geocoding behavior to a skill whose stated purpose is offline raster standardization, weighted fusion, and classification. That mismatch is dangerous because it introduces undisclosed external-data dependencies and expands the attack/privacy surface beyond what users would reasonably expect from an offline geospatial processing skill.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code performs outbound HTTP requests to Open-Meteo and Nominatim using user-supplied place names, despite the skill being described as an offline numpy-equivalent raster fusion tool. This creates a real confidentiality and supply-chain risk: user inputs are disclosed to third parties, behavior now depends on remote services, and a supposedly offline workflow can unexpectedly fail or change due to network responses.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
User-provided place queries are sent to third-party geocoding services without any disclosure or consent mechanism in this file. Even seemingly simple place names can reveal project locations, customer sites, or areas of interest, so silent transmission creates a privacy and data-handling risk that is amplified by the skill's claimed offline context.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The code writes resolved AOI manifests to persistent cache files without a user-facing notice or consent flow. While lower severity than active exfiltration, this can still leave privacy-sensitive location traces on disk, especially on shared workstations or environments with backups and telemetry.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module contains hardcoded fallback credentials, including a concrete Earthdata username and password, in source code. Hardcoded secrets are highly dangerous because they can be extracted by anyone with code access, reused without user knowledge, and may grant unauthorized access to third-party services or expose the associated account to abuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
User-provided place queries are sent to third-party geocoding services without any user-facing disclosure in this file or evidence of consent. This is dangerous because location queries can be sensitive, and silent transmission to external providers violates expectations for an offline raster-processing skill and may create compliance or privacy issues.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The code hard-codes an Accept-Language header of zh-CN for Nominatim requests without user choice. While not code-execution dangerous, it can bias returned results, reveal assumptions about the user/context, and silently alter output semantics in a way users did not request, especially problematic in geospatial workflows where place disambiguation matters.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
83% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
83% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
83% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
80% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
82% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
82% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
80% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
90% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15