ClawHub
Back to skill

Security audit

geoskill-slum-mapping

Security checks across malware telemetry and agentic risk

Overview

The main tool is a local raster mapper, but the package also includes under-disclosed network, credential, and caching helpers, including a hardcoded password.

Review this package before installing in a sensitive environment. The main slum-mapping CLI appears local, but the bundle contains extra network and credential utilities, hardcoded fallback credentials, and a location cache. Do not use it for enforcement, eviction, discrimination, or punitive targeting, and prefer a cleaned package that removes unused credential/geocoding/download helpers or clearly gates them behind user opt-in.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation declares an offline/local raster workflow, yet analysis detected capabilities for environment access, file read/write, shell execution, network use, and no corresponding permission declaration. This creates an implicit trust gap: users may run a skill believing it is constrained while it can access broader system and network resources, increasing the chance of unintended data exposure or command execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a substantial description-behavior mismatch: the skill presents itself as a local slum-mapping tool, but the detected behavior includes geocoding, remote downloads, broad product registries, credential handling for multiple services, and even embedded fallback credentials. Such hidden functionality materially expands the attack surface and can lead to secret leakage, unapproved network egress, or use of third-party accounts without the user's informed consent.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The AOI helper sends user-supplied place names to third-party geocoding services and also persists results to a local cache in the user's home directory. In a geospatial analytics skill this may be functional, but it still creates a privacy and data-governance risk because potentially sensitive operational locations are disclosed to external services and stored locally without strong consent or containment controls.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The documentation claims passwords are not cached, but `load_user_secrets()` copies secrets from the user secrets file into the process-global `_DEFAULTS` map and retains them for the lifetime of the process. This inconsistency can mislead operators into believing secrets are ephemeral when they actually persist in memory and are exposed to any code path that can read module globals.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The README explicitly promotes mapping 'slums' and 'shanty areas' from geospatial indicators but does not include any safeguards, misuse warnings, or restrictions around identifying vulnerable communities. In this context, the output can enable stigmatization, discriminatory targeting, forced eviction planning, or other harmful actions against already at-risk populations, so the omission of sensitivity guidance is a meaningful security and safety issue.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User place queries are transmitted to Open-Meteo and optionally Nominatim without any warning in this code path, which can leak sensitive target locations to third parties. In a slum-mapping context, locations may reveal vulnerable communities or analyst interest areas, increasing the privacy and ethical risk of the disclosure.

Missing User Warnings

Low
Confidence
82% confidence
Finding
Resolved location data is written to a predictable cache directory under the user's home folder without explicit notice or lifecycle controls. While not remote code execution, this can expose sensitive location history to other local users, backups, or forensic collection on shared or managed systems.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module contains hardcoded fallback credentials with a real-looking Earthdata username and password. Hardcoded secrets in source are dangerous because anyone with repository or package access can recover and misuse them, and downstream deployments may silently authenticate with unintended shared credentials.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
The code unconditionally sends an Accept-Language header of zh-CN for Nominatim requests, overriding user or environment preferences without consent. This can disclose locale assumptions to a third party and bias responses toward Chinese-language results, which is a privacy and query-quality issue even though the direct security impact is limited.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15