ClawHub
Back to skill

Security audit

geoskill-post-fire-recovery

Security checks across malware telemetry and agentic risk

Overview

The main tool is a local post-fire raster analyzer, but the package also contains under-disclosed network, credential, and home-directory cache code.

Put this skill in Review before installation. The core CLI appears to perform the advertised local raster analysis, but the package should remove or clearly document the bundled geocoding, downloader, home-directory cache, and credential helper code, and the exposed Earthdata fallback credentials should be revoked. Install only in an environment where unexpected network-capable helper modules and local credential reads are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill metadata declares an offline geospatial analysis workflow, but the detected capabilities include network, shell, environment access, and arbitrary file read/write without any corresponding permission declaration. This creates a trust gap: operators may run the skill assuming limited local raster processing while it can access sensitive local data or invoke external commands, increasing the chance of unintended data exposure or unsafe execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a strong description-behavior mismatch: the skill claims post-fire dNBR/NDVI analysis, yet the detected behavior includes geocoding, generic HTTP downloading, credential management, secrets/.netrc access, and even hardcoded NASA Earthdata credentials. Hidden downloader and credential-handling functionality materially expands the attack surface and could enable unauthorized network access, credential leakage, or misuse of user trust under the guise of a benign remote-sensing workflow.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The module performs outbound geocoding requests to third-party services and also supports persistent caching under the user's home directory, which expands the skill's behavior beyond local fire-recovery analysis. This creates a real privacy and supply-chain exposure because user-provided place names and derived AOI data can leave the local environment or persist on disk without clear necessity or disclosure.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The docstring explicitly claims passwords are not hardcoded, but the module embeds fallback Earthdata username and password in source. Hardcoded credentials are dangerous because anyone with code access can recover them, reuse them across environments, and potentially access external data services under that account.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This file implements place-resolution and external geocoding behavior even though the skill is described as post-fire recovery analysis from dNBR and NDVI time series. Scope drift matters because it expands the skill’s capabilities and attack/privacy surface beyond what users would reasonably expect, including transmitting location queries to third-party services and introducing network-dependent behavior into an analysis skill.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code sends user-supplied place names to Open-Meteo and Nominatim over the network without that behavior being justified by the declared post-fire recovery scope. This creates a real data exposure and supply-chain surface: user queries may contain sensitive locations, and third-party responses directly influence downstream AOI selection and analysis results.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
User-supplied location queries are sent to Open-Meteo and potentially Nominatim without any user-facing warning, which is a genuine data exposure issue. Even if the data is 'just a place name,' AOI inputs can reveal sensitive operational, environmental, or business interests, especially in a geospatial fire-recovery workflow.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code writes resolved AOI manifests into a persistent cache under the home directory without warning, creating local privacy leakage and residual data risk. Cached location history may be readable by other local processes/users depending on system configuration, and it persists longer than the user may expect.

Missing User Warnings

High
Confidence
99% confidence
Finding
Embedding fallback credentials in source creates a standing secret exposure risk and may silently authorize network access without explicit user consent. In the context of a geospatial skill that fetches remote Earthdata resources, this can lead to unauthorized service use, account abuse, and difficult-to-trace data access under a shared identity.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
User-provided place queries are transmitted to third-party HTTP APIs without any visible user-facing warning or consent in this file. Even if sent over HTTPS, the issue is privacy and expectation mismatch: a user may believe they are performing local geospatial analysis while their queried locations are disclosed to external providers.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
89% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15