ClawHub
Back to skill

Security audit

geoskill-spatial-storytelling

Security checks across malware telemetry and agentic risk

Overview

The main story-map tool is mostly local, but the package includes under-disclosed credential, network, and download helpers, including a hardcoded Earthdata password.

Review this package before installing. The documented story generation path is local, but the shipped helper code contains a plaintext Earthdata password and can read user-level credential files and make network requests if those helpers are used. Prefer a build that removes hardcoded credentials, documents any network and credential behavior, fixes the vendored provenance metadata, and pins dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill metadata declares no permissions, yet the described/runtime capabilities include file, shell, environment, network, and write access. This creates a trust and review gap: users may approve or execute the skill believing it is narrowly scoped and offline, while it can access broader resources than disclosed.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a strong description-behavior mismatch: the skill claims to be an offline storytelling tool, but analysis indicates geocoding, external HTTP access, downloading, credential handling, and even hardcoded fallback credentials. That combination can expose secrets, exfiltrate data, or perform unexpected remote interactions far beyond user expectations, making the skill materially more dangerous in this context.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the stated skill being reviewed ('geoskill-spatial-storytelling'). This undermines supply-chain traceability and makes it harder to verify that the bundled code is the intended dependency set, increasing the risk of accidental code substitution or unnoticed malicious insertion.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The module hardcodes default Earthdata credentials in source code, including a plaintext username and password. Even if intended as a fallback, embedding live credentials in a shipped skill creates immediate secret exposure risk, unauthorized account use, credential reuse risk, and accidental propagation into forks, packages, logs, or reports.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
This skill reads from broad user credential stores such as ~/.netrc and ~/.geoskill/secrets.json, which expands access beyond narrowly scoped storytelling functionality. In the context of a map storytelling skill, this increases the blast radius: any downstream code path using this helper can harvest unrelated user credentials without a clear per-service opt-in.

Missing User Warnings

High
Confidence
98% confidence
Finding
The code silently consumes hardcoded fallback credentials with no user disclosure, meaning operators may unknowingly authenticate with embedded shared secrets. That makes detection harder, masks insecure configuration, and can lead to unauthorized or surprise external account usage in environments that appear unconfigured.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The Nominatim request hard-codes Accept-Language to zh-CN,zh;q=0.9 without user choice, causing user queries and returned place metadata to be processed under a forced locale. This can create privacy and integrity issues by unexpectedly biasing results, altering labels, and leaking a locale preference unrelated to the actual user, especially when the skill is used outside Chinese-language contexts.

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
90% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True
Confidence
91% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
matplotlib
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
matplotlib
geopandas
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
matplotlib
geopandas
shapely
Confidence
98% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
matplotlib
geopandas
shapely
Confidence
96% confidence
Finding
matplotlib

Unpinned Dependencies

Low
Category
Supply Chain
Content
rasterio
scipy
matplotlib
geopandas
shapely
Confidence
98% confidence
Finding
geopandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
scipy
matplotlib
geopandas
shapely
Confidence
96% confidence
Finding
shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
77% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
84% confidence
Finding
scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15