ClawHub
Back to skill

Security audit

geoskill-spatial-index-builder

Security checks across malware telemetry and agentic risk

Overview

The main tool is a local spatial-index benchmark, but the package also includes undisclosed network, download, and credential-handling code that does not fit that purpose.

Install only after reviewing the bundled _geoskill_core files. The benchmark entrypoint appears local, but the package contains unrelated credential, geocoding, caching, and download helpers; remove those modules or get a narrower package before using it in an environment with real credentials or sensitive geospatial queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (43)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares no permissions while the detected capabilities include file access, shell execution, environment access, and network use. Even if some capabilities are only incidental dependencies, the absence of explicit permission disclosure misleads users and reviewers about the trust boundary and can enable unexpected data access or command execution when the skill is run.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is a local spatial-index benchmark, but the analyzed behavior reportedly includes geocoding, HTTP downloading, credential management for multiple external services, and hardcoded fallback credentials. This is a severe transparency violation and strongly suggests hidden functionality unrelated to the stated task, creating risk of secret exfiltration, unauthorized remote access, or supply-chain abuse.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored metadata shows this skill bundles a different capability set ('landsat-download') than the declared spatial-index-building purpose. That mismatch is a supply-chain and hidden-capability risk because it can introduce unexpected code paths, network access, or sensitive-data handling that reviewers and users would not anticipate from the skill description.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The presence of files such as 'safe_download.py' and 'credentials.py' implies download and credential-handling functionality inside a skill whose stated purpose is local spatial indexing and benchmarking. In this context, those capabilities are unjustified and increase the attack surface for unauthorized network access, secret collection, or misuse of credentials if the vendored code is invoked.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and Nominatim) without an explicit consent gate, which can leak sensitive location intent or operational context. In a skill whose stated purpose is local spatial-index construction and benchmarking, unexpected outbound requests materially expand the privacy and supply-chain attack surface.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The module persists query-derived location data under the user's home directory, which can expose sensitive place names or resolved AOIs to other local processes, backups, or shared-user environments. Because this persistence is on by default and unrelated to core benchmarking, it creates avoidable privacy risk and unwanted data retention.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module is a credential-management component embedded in a skill whose stated purpose is spatial index construction and benchmarking. The mismatch materially increases risk because it expands the skill's privilege surface to local secrets and external accounts without a clear functional need, which is a common indicator of overprivileged or potentially dual-use code.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The module reads and manages secrets for multiple unrelated services, including OpenAI, CMA, EOG, FIRMS, and Earthdata, despite the skill being described as a spatial-index builder. Access to unrelated credentials violates least privilege and creates unnecessary opportunities for secret harvesting or later misuse if any other part of the skill calls these helpers.

Intent-Code Divergence

Critical
Confidence
99% confidence
Finding
The documentation claims passwords are not hardcoded in source, yet the module contains a hardcoded Earthdata username and password in _DEFAULTS. Hardcoded credentials are directly exposed to anyone with source access and may enable unauthorized use of an external account, while the contradictory documentation can also mislead reviewers and operators into underestimating the risk.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
This file introduces a reusable remote download primitive into a skill whose declared purpose is spatial-index construction and benchmarking. Even though the implementation includes safety features like atomic writes and optional hash checks, the capability itself materially expands the skill's attack surface by enabling arbitrary network retrieval and local file placement outside the stated scope.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The exported safe_download and safe_download_many functions provide general-purpose remote file download capability with caller-controlled URLs, filenames, and output paths. In the context of a spatial-index benchmarking skill, this is an unnecessary powerful primitive that could be repurposed to fetch untrusted content, stage payloads locally, or access internal network resources if user input can influence the URL.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The public resolve_place API adds place-name geocoding and can trigger external network lookups, which is materially broader than the declared purpose of building and benchmarking spatial indexes. In an agent context, this unexpected capability can exfiltrate user-supplied location queries to third parties and expands the skill's attack surface beyond what operators would reasonably permit for an indexing-only tool.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The legacy fallback preserves full network geocoding behavior via Open-Meteo and Nominatim, so even if the core module is unavailable the file still performs undeclared outbound requests. This makes capability control unreliable: operators may think they are running a local spatial-index utility, but failure paths still leak user queries and depend on external services.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The helper functions directly perform outbound HTTP requests to external geocoding services, which is unjustified for the stated benchmarking/index-building function of the skill. Even absent malicious intent, this can disclose sensitive place names, create compliance issues, and introduce dependency on third-party responses into workflows expected to be local and deterministic.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Location queries are transmitted to external services without user-facing disclosure, creating a privacy vulnerability because place names can reveal sensitive personal, business, or operational information. The risk is higher here because the skill description does not suggest any networked geocoding behavior, so users may reasonably assume local-only processing.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code writes resolved location information to persistent cache files without informing the user, creating undisclosed retention of potentially sensitive geographic data. Persistent local storage can increase exposure through local compromise, multi-user systems, backups, or later forensic recovery.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code ships hardcoded fallback credentials and silently uses them when stronger sources are absent. This is dangerous because operators may unknowingly run the skill under a shared or compromised account, making abuse difficult to detect and potentially exposing third-party data access or billing under someone else's identity.

Natural-Language Policy Violations

Medium
Confidence
74% confidence
Finding
The code hard-codes Accept-Language to zh-CN/zh for Nominatim requests without user choice. This is primarily a privacy and policy issue: it leaks a locale preference to the third party and can bias results in ways the caller did not request, which is undesirable in a generic geospatial skill.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
89% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
89% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
89% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
90% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
90% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
90% confidence
Finding
.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15