ClawHub
Back to skill

Security audit

geoskill-polarimetric-decomposition

Security checks across malware telemetry and agentic risk

Overview

The advertised SAR decomposition tool is mostly local, but the package also includes under-disclosed network geocoding, download, and credential-handling code that does not fit the stated purpose.

Review this carefully before installing. The main decomposition workflow appears local, but the package carries extra geospatial helper code that can use the network, cache locations in the home directory, and inspect credential stores. Install only if you accept that broader bundled capability or can remove/disable the unrelated helper modules and rotate the exposed Earthdata credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)

Lp3

Medium
Category
MCP Least Privilege
Confidence
74% confidence
Finding
The skill advertises local/offline polarimetric decomposition, yet the detected capabilities include shell, file read/write, environment access, and network without any declared permissions or justification in the manifest. This creates an opaque trust boundary: users and hosting platforms cannot accurately assess that the skill may access local files, secrets, or external services, increasing the risk of unintended data exposure or unsafe execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a strong description-behavior mismatch: a narrowly described SAR decomposition skill allegedly also performs geocoding, external network access, generic downloading, credential harvesting from environment/.netrc/secrets files, and even contains hardcoded default credentials. In the context of an offline scientific processing skill, these extra behaviors are highly suspicious because they expand the attack surface far beyond user expectations and could expose secrets or download and execute untrusted data flows.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored core metadata claims the bundled core belongs to a different skill ('landsat-download') than the actual skill being analyzed. This creates a software supply chain integrity problem: tooling or reviewers may trust hashes, provenance, or compatibility assumptions that do not actually correspond to this skill, making it easier for the wrong dependency set or mislabeled code to be shipped unnoticed.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file implements AOI geocoding, online lookup, and caching behavior that is not aligned with the stated purpose of a polarimetric SAR decomposition skill. Capability mismatch is dangerous because it expands the skill's attack and privacy surface beyond user expectations, including network access and location handling that a decomposition-only tool should not need.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The module sends place queries to external geocoding services, creating unnecessary outbound data flow for a skill described only as SAR decomposition. This can leak sensitive user-supplied locations and introduces dependency on third-party services without clear necessity in the declared skill context.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code defines a persistent cache directory under the user's home directory for location-resolution artifacts, which is outside the expected behavior of a decomposition-focused skill. Persistent storage of location-related data can create privacy exposure and forensic residue even when users do not expect local retention.

Context-Inappropriate Capability

High
Confidence
91% confidence
Finding
This module centralizes access to multiple unrelated credentials, including OpenAI, CMA, FIRMS, EOG, and Earthdata, despite the skill being described as a polarimetric SAR decomposition skill. Broad credential-handling code increases the attack surface and makes it easier for any compromised or overly-permissive skill component to access secrets unnecessary for its function, violating least privilege.

Intent-Code Divergence

Critical
Confidence
99% confidence
Finding
The documentation says passwords are not hardcoded, but the module includes a real default Earthdata username and password in _DEFAULTS. Hardcoded credentials can be extracted from source control, package artifacts, or downstream copies, enabling unauthorized account access and creating a severe secret-management failure.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The public API exposed by this file performs place-resolution and forwards user-supplied strings into geocoding logic, which is unrelated to the declared polarimetric SAR decomposition purpose. In a skill ecosystem, undeclared location-resolution and outbound API behavior increases data exfiltration and hidden-capability risk because user inputs may be transmitted to third-party services without expectation from the manifest.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The legacy fallback contains a full implementation for calling Open-Meteo and Nominatim over the network, preserving undeclared geocoding capability even when the core module fails. Hidden fallback paths are especially risky because reviewers may trust the adapter description while the code still transmits user-provided place names externally.

Context-Inappropriate Capability

High
Confidence
89% confidence
Finding
This module hardcodes external geocoding endpoints, enabling outbound network requests from a skill whose stated function is SAR decomposition rather than online place lookup. In this context, the mismatch makes the capability more dangerous because users and platform operators may not expect sensitive location queries to leave the environment.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring frames the file as a simple adapter shim, but the module also embeds substantial legacy geocoding logic with network behavior. This discrepancy can mislead reviewers and maintainers, causing dangerous capabilities to be overlooked during review, especially in a skill whose manifest describes a different domain.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Place names are transmitted to third-party geocoding providers without any user-facing disclosure or consent mechanism. Because location queries may contain sensitive operational or personal information, silent transmission creates a privacy risk that is amplified by the skill's misleading decomposition-only description.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Resolved location data is written to persistent cache files in the user's home directory without user-facing disclosure. Cached AOI manifests may reveal sensitive places of interest over time, creating a privacy and data-retention issue disproportionate to the skill's declared purpose.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The module hard-codes an Accept-Language preference for Chinese responses when querying Nominatim, without giving users control. While not a direct code-execution issue, forced locale selection can expose assumptions about the user, affect query results, and reduce transparency around outbound request metadata.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code ships hardcoded fallback credentials and normalizes their use as defaults, which is an unsafe secret-distribution practice. Even without an explicit warning, the core issue is that real secrets appear in code and may be silently used in production, enabling unauthorized access and accidental credential reuse.

Natural-Language Policy Violations

Medium
Confidence
74% confidence
Finding
Forcing an Accept-Language value of zh-CN for Nominatim requests without user choice or documentation is a privacy and quality concern: it may influence returned data, leak regional assumptions, and produce unexpected behavior for non-Chinese queries. While not severe on its own, it reinforces that the module performs undeclared external requests with hidden request shaping.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
87% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
86% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
86% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
85% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
90% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15