ClawHub
Back to skill

Security audit

geoskill-semantic-segmentation

Security checks across malware telemetry and agentic risk

Overview

Review is recommended because the advertised offline segmentation skill bundles unrelated online geocoding, downloading, and credential-handling code.

Install only if you are comfortable reviewing or removing the bundled shared core modules. Treat this package as not purely offline despite the main segmentation script being local-only, and avoid using it with sensitive locations or local credential stores until the publisher scopes and documents the network, cache, and credential behavior and removes the hardcoded credential fallback.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation claims offline/local processing and declares no permissions, yet static analysis detected capabilities for environment access, file I/O, network, and shell use. This mismatch weakens trust boundaries: a caller may invoke the skill assuming no sensitive access, while the implementation could read local files, use credentials from the environment, make outbound requests, or execute subprocesses.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a substantial description-behavior mismatch: the skill presents itself as an offline numpy-equivalent segmentation tool, but the analyzed behavior reportedly includes network access, remote downloading, credential handling with fallback secrets, AOI/geocoding, and unrelated registries. Such hidden functionality materially expands the attack surface and can lead to unexpected data egress, secret use, or execution paths far beyond user expectations.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored metadata claims the embedded component belongs to a different skill, 'landsat-download', which does not match the declared semantic-segmentation skill. This breaks provenance and review assumptions, making it easier to smuggle code from an unrelated capability set into an offline image-processing skill without clear disclosure.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The vendored metadata references a download-oriented component for a skill described as an offline numpy-equivalent segmentation workflow. That mismatch expands the apparent trust boundary and may introduce unnecessary network, credential, or data-acquisition code paths that are inconsistent with the skill's stated purpose, increasing the risk of hidden behavior or accidental exposure.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file performs external geocoding requests and persists query results under the user's home directory, which exceeds the stated offline semantic-segmentation scope and introduces unexpected data egress and local state changes. In a segmentation-focused skill, hidden network access and cache writes are dangerous because users may supply sensitive AOI names and reasonably expect purely local processing.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
This offline semantic-segmentation skill ships a credential-management module for multiple remote services that are unrelated to its stated purpose. That unnecessary credential surface increases the blast radius: any code path in the skill can now access secrets for Earthdata, FIRMS, CMA, OpenAI, and EOG, which is risky even if this file itself does not transmit them.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The module explicitly supports retrieving OpenAI and several remote-service credentials even though the skill is described as an offline numpy/sklearn segmentation implementation. In this context, hidden credential access is more suspicious because users would not reasonably expect an offline raster classifier to inspect local secrets for unrelated external systems.

Intent-Code Divergence

Critical
Confidence
99% confidence
Finding
The module claims passwords are not hardcoded in skill source, yet `_DEFAULTS` contains a real-looking Earthdata username and password. Hardcoded credentials are a direct secret-exposure vulnerability: anyone with source access can recover them, reuse them, or test them against external services.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file vendors a fully capable generic HTTP downloader with retry, resume, and arbitrary URL support, which materially expands the skill's capabilities beyond the declared offline semantic-segmentation scope. In an agent setting, this creates an unnecessary network-enabled primitive that could be used to fetch untrusted code, data, or payloads, undermining scope restrictions and increasing supply-chain and data-exfiltration risk.

Context-Inappropriate Capability

High
Confidence
92% confidence
Finding
The `_http_get` implementation introduces direct outbound network access via `requests`/`urllib` despite the skill being described as offline. That mismatch is dangerous because it gives the skill undeclared reachability to external resources, enabling retrieval of attacker-controlled content or unauthorized communication in environments that may trust the offline designation.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The advertised skill is an offline semantic-segmentation component, but this function exposes network-based place resolution and passes through parameters that enable external geocoding. That creates hidden outbound data flow and capability expansion beyond the stated purpose, which is dangerous in agent environments because user inputs or AOI names may be sent to third-party services without clear consent or expectation.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The legacy fallback directly performs HTTP requests to Open-Meteo and Nominatim, contradicting the skill's claimed offline numpy-equivalent behavior. This creates undisclosed exfiltration risk, dependency on external services, and a bypass path even when the core module is unavailable, so the networked behavior is not merely incidental but built-in resilience for online operation.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
This code implements full place-name resolution logic, candidate scoring, and optional secondary geocoder lookup, none of which is justified by an offline semantic-segmentation skill. In context, this makes the skill more dangerous because it embeds unrelated data acquisition functionality that can transmit user-provided locations externally and broadens the operational scope beyond least privilege.

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The docstring presents the module as a compatibility shim with delegated behavior, but the file actually retains a complete standalone network-capable geocoding implementation. That mismatch is security-relevant because reviewers and operators may underestimate the module's capabilities, causing hidden network behavior to pass trust and policy checks.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Place queries are sent to third-party geocoding services without any in-band warning, consent, or clear indication that user-provided locations leave the local environment. This can leak sensitive operational, personal, or proprietary location intent, especially because the skill is described as offline-first segmentation rather than a cloud geocoding tool.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code writes resolved AOI manifests to a persistent cache in ~/.geoskill_core_cache without user-facing notice or consent. Persistent storage of location queries can expose sensitive research areas or user interests to other local users, backup systems, or later forensic inspection.

Missing User Warnings

High
Confidence
99% confidence
Finding
Hardcoded fallback credentials are embedded in the module without any warning or forced override, meaning deployments may silently authenticate using bundled secrets. This is dangerous because it hides secret use, enables credential reuse across environments, and makes compromise of the source equivalent to compromise of the account.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
82% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
82% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
82% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
80% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
84% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
84% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
84% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
90% confidence
Finding
~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15