ClawHub
Back to skill

Security audit

geoskill-precision-forestry-monitoring

Security checks across malware telemetry and agentic risk

Overview

The main forestry tool is local, but the package also includes under-disclosed network, caching, download, and credential helper code, including a hardcoded Earthdata password.

Review this skill before installing. The advertised CLI appears to process local GeoTIFF or synthetic forestry data, but the package also ships hidden-by-documentation network geocoding, home-directory caching, generic download, and credential helper code. Avoid using it in sensitive environments unless those helper modules are removed or clearly disabled, and rotate/remove the exposed Earthdata credentials before publication.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation declares an offline, local-only forestry workflow, yet the detected capabilities include network, shell, environment access, and arbitrary file read/write without any declared permissions. This creates a transparency and least-privilege problem: users and orchestration systems cannot accurately assess or constrain what the skill may access, increasing the chance of unexpected data exposure or unsafe execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrow forestry analysis, but the detected behavior includes geocoding, generic downloading, multiple credential managers, and even hardcoded fallback usernames/passwords for unrelated services. This mismatch is dangerous because it hides a much broader attack surface than users expect, enabling silent network egress, credential misuse, and access to external services unrelated to the stated workflow.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code sends user-provided place queries to Open-Meteo and optionally Nominatim without any in-file disclosure, consent flow, or default-off control. Even if place names are not highly sensitive in all cases, AOI queries can reveal project locations, field sites, or operational interests, and the forestry context can make those locations commercially or environmentally sensitive.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The module persists resolved queries to a cache in the user's home directory without visible notice. Stored place names and derived AOIs can leak sensitive site information to other local users, backups, support bundles, or later processes that inspect home-directory artifacts.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module hardcodes fallback credentials, including a plaintext Earthdata username and password, directly in source. Hardcoded secrets are inherently dangerous because anyone with repository or package access can recover them, and downstream code may silently authenticate with those credentials, enabling unauthorized service use, account abuse, or credential reuse attacks.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
97% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
97% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
scikit-learn
Confidence
98% confidence
Finding
scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
88% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
86% confidence
Finding
scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15