ClawHub
Back to skill

Security audit

geoskill-sandstorm-source-identification

Security checks across malware telemetry and agentic risk

Overview

The main sandstorm tool is coherent, but the package also includes under-disclosed credential, network, and home-directory persistence helpers that users should review before installing.

Review this package before installing. The advertised command appears to run local geospatial analysis, but the bundled helper modules include online geocoding, arbitrary download utilities, home-directory caches, local credential-store reads, and an embedded Earthdata password. Install only in an environment where those files and network access are acceptable, and prefer a cleaned package with secrets removed, network/cache behavior disclosed or disabled, and pinned dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises local geospatial processing, yet the analyzer detected capabilities for environment access, file read/write, shell, and network without any declared permissions. That creates a trust and review gap: users and the hosting platform cannot accurately assess what the skill may access or execute, increasing the risk of unexpected data exposure or command execution if the underlying implementation uses those capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a significant description-behavior mismatch: the skill claims to perform a narrow scientific analysis, but the reported implementation also includes credential handling, reads secrets from environment and local secret stores, performs online geocoding and downloads from arbitrary URLs, and exposes broad reusable registry/utilities unrelated to the stated purpose. Hidden credential access and arbitrary network retrieval materially expand the attack surface and can enable secret leakage, unintended outbound requests, or misuse under the cover of a benign geospatial skill.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The module sends user-supplied place names to third-party geocoding services and also persists results under the user's home directory by default, but provides no built-in notice, consent flow, or privacy control at the point of use. In a geospatial skill, queried locations may reveal sensitive user interests or operational areas, so silent network disclosure and disk persistence create a real privacy and data-handling risk even if no code execution is involved.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module hardcodes fallback credentials, including a concrete username and password, directly in source code. Hardcoded secrets are highly dangerous because anyone with repository access can recover them, and deployments may silently authenticate with shared credentials, enabling unauthorized access, account abuse, and secret reuse exposure.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15