ClawHub
Back to skill

Security audit

geoskill-post-disaster-reconstruction

Security checks across malware telemetry and agentic risk

Overview

The advertised tool is mainly a local image-analysis skill, but it also bundles undisclosed credential, geocoding, cache, and downloader helpers that do not fit the stated offline-only purpose.

Review this package before installing in a sensitive environment. The main advertised command appears to process local/synthetic raster data and write local outputs, but the package includes extra helpers that can use credentials, read local secret stores, call external geocoding services, cache locations under the home directory, and download arbitrary URLs. Remove or isolate those helpers, rotate the exposed Earthdata password if it is real, and pin dependencies before using it with sensitive disaster-response locations or credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a significant description-behavior mismatch if the associated skill code includes credential management, hardcoded Earthdata fallback credentials, online geocoding, external API access, and a generic downloader despite the documentation claiming a focused offline reconstruction-analysis tool. Hidden credential handling and undocumented network functionality materially expand the attack surface, can leak secrets, and violate user expectations about local-only processing.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored metadata declares the embedded component as skill 'landsat-download', which conflicts with the advertised skill purpose of post-disaster reconstruction analysis. This kind of identity mismatch undermines supply-chain transparency and can conceal reused or swapped code, making review, provenance validation, and operator trust materially weaker.

Context-Inappropriate Capability

Medium
Confidence
72% confidence
Finding
The helper performs arbitrary network retrieval from caller-controlled URLs without any scheme, host, or address restrictions. In an agent environment, this can enable SSRF-style access to internal services or metadata endpoints, and the downloaded content is then written to disk for later use by other components.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
User-supplied place names are sent to third-party geocoding services without any user-facing disclosure or explicit consent flow. In this skill context, queried locations may reflect sensitive post-disaster operational areas, making silent transmission of location intent to external services a meaningful privacy and data-governance risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The module persistently stores resolved queries under the user's home directory without disclosure, which can leak sensitive operational locations to other local users, backups, forensic collection, or later unintended reuse. In a disaster-reconstruction workflow, AOI names may reveal incident sites, internal planning targets, or protected locations even if the cache key is hashed, because the cached JSON still contains the original query and resolved metadata.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code contains hardcoded fallback credentials, including a concrete Earthdata username and password. Embedding live credentials in source is dangerous because anyone with code access can extract and reuse them, and any downstream package, logs, backups, or disclosures may leak them further. In this skill context, a credential-management module makes such leakage especially risky because the module is explicitly designed to retrieve secrets.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The functions send user-supplied place queries to third-party geocoding providers over the network without any disclosure, consent, or local-only alternative in this file. This can leak sensitive location intent or incident-related place names to external services, which is especially relevant in a post-disaster context where queried sites may be operationally sensitive.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
98% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
98% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
98% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
89% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15