ClawHub
Back to skill

Security audit

geoskill-suitability-analysis-framework

Security checks across malware telemetry and agentic risk

Overview

The main tool is a local suitability-analysis CLI, but the package also contains under-disclosed network, download, caching, and credential-handling helpers including hardcoded Earthdata credentials.

Review this package before installing in an environment with sensitive credentials or private location queries. The main CLI may run locally, but the package should remove or clearly document the vendored geocoding, download, cache, and credential modules, delete and rotate the hardcoded Earthdata credentials, and pin dependencies before approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares no permissions, yet the documented and statically detected capabilities include file access, shell execution, environment access, and potential network use. Even if the markdown claims offline/local behavior, missing permission declarations reduce transparency and can cause users or orchestrators to grant trust to a skill that is capable of more sensitive operations than advertised.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
This is a serious description-behavior mismatch: the skill is presented as a local suitability-analysis framework, but static analysis indicates additional behaviors such as online geocoding, downloading, credential handling, secret-file access, and even hardcoded default Earthdata credentials. Hidden credential access and undeclared network/data acquisition capabilities materially expand the attack surface and could expose secrets or perform unintended external interactions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This helper expands the skill’s behavior beyond pure local suitability analysis by sending user-supplied place names to third-party geocoding services and persisting results to a local cache directory. That creates privacy and policy risk: AOI inputs may reveal sensitive locations, and local file writes may be unexpected in restricted or sandboxed environments.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
This file implements broad credential collection and secret-resolution logic that is materially outside the declared geospatial suitability-analysis purpose. In skill ecosystems, unjustified secret-handling increases the attack surface because the skill can access local secrets, environment credentials, and network-service accounts unrelated to its stated function.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
Support for OPENAI_API_KEY is not justified by the stated suitability-analysis workflow, so it expands the set of accessible secrets without clear need. Unnecessary support for external AI credentials can enable data exfiltration or unexpected third-party transmission if other code paths later use the key.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The module claims passwords are not hardcoded in skill source, yet it embeds a concrete Earthdata username and password in _DEFAULTS. Hardcoded credentials are immediately dangerous because anyone with source access can reuse them, and they often get propagated into forks, logs, packages, and automated scans.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The legacy fallback performs live network geocoding to third-party services using user-supplied place names, which introduces an undeclared outbound data flow and expands the skill’s capability beyond the stated suitability-analysis pipeline. In a geospatial analysis context this can leak sensitive locations or internal project queries and create nondeterministic behavior based on external services.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
These functions send user-provided place queries to Open-Meteo and Nominatim without any demonstrated necessity tied to the declared skill purpose. Even if intended for convenience, unnecessary network resolution broadens attack surface, exposes potentially sensitive query data, and makes results dependent on third-party availability and policy.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code transmits raw geocoding queries to Open-Meteo and Nominatim without any disclosure or consent mechanism in this file. Place names and AOI terms can encode sensitive operational, personal, or business location data, so undisclosed exfiltration to third parties is a real privacy and compliance concern.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
Forcing the Accept-Language header to a Chinese locale without user choice can leak user/context assumptions and alter results in ways the caller did not request. While lower severity than raw data exfiltration, it is still a privacy and integrity issue because locale selection may influence remote processing and returned place matches.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code contains hardcoded fallback credentials for a real account and will silently use them when environment variables are absent. This creates unauthorized account reuse risk, accidental credential disclosure, and hidden outbound authentication under a victim user’s execution context.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code transmits raw user-supplied place queries to external services via HTTP requests without any explicit warning or consent mechanism in this file. Place names can be sensitive in enterprise, research, or personal contexts, so silent exfiltration to third parties creates a real privacy and compliance risk.

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
84% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True
Confidence
82% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15