ClawHub
Back to skill

Security audit

geoskill-temporal-interpolation

Security checks across malware telemetry and agentic risk

Overview

The skill’s main NDVI smoothing command is mostly local, but the package includes unrelated credential, downloader, and geocoding code, including hardcoded credentials, that should be reviewed before installation.

Install only if you are comfortable reviewing or removing the bundled _geoskill_core credential, downloader, and geocoding modules first. The core smoothing command appears local, but the package contains under-disclosed code that can read local credential stores, use hardcoded Earthdata credentials, contact third-party geocoding services, and download arbitrary URLs if those helpers are invoked.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares no permissions, yet the documented and analyzed capabilities indicate access to environment variables, filesystem, shell, and network. This creates a trust and review gap: operators may approve or invoke the skill assuming it is offline/local, while it can access broader resources than disclosed.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared purpose is simple local NDVI temporal interpolation, but the analyzed behavior includes geocoding, external network access, a generic downloader, credential management, and even hardcoded fallback Earthdata credentials. This mismatch is dangerous because it conceals sensitive functionality, increases attack surface, and may expose secrets or cause unintended data exfiltration under the guise of an offline geospatial processing skill.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the actual temporal interpolation skill. This supply-chain identity mismatch undermines provenance and reviewability: operators may validate or trust the wrong component set, and automated tooling may apply incorrect expectations or allow unintended code reuse. In a security context, mislabeled vendored content can conceal dependency substitution or packaging mistakes that are hard to detect later.

Context-Inappropriate Capability

High
Confidence
85% confidence
Finding
The module sends user-supplied place queries to external geocoding services, creating an outbound data flow to third parties that may expose sensitive location intent or user data. In a skill advertised primarily for NDVI time-series smoothing, this network capability expands the trust boundary and can leak inputs without explicit user awareness.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This module gives an NDVI temporal-interpolation skill a broad credential broker for multiple unrelated external services, including OpenAI, FIRMS, CMA, and EOG. That unnecessary capability expands the attack surface and enables a compromised or misused skill component to harvest or use secrets far beyond what is required for its stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The exported API explicitly exposes retrieval functions for OpenAI, FIRMS, CMA, and EOG credentials even though they are unrelated to NDVI smoothing/interpolation. In a skill environment, such generic secret-access helpers can be abused by downstream code to access unrelated accounts and external services without user expectation.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring says passwords are not cached, but `load_user_secrets()` writes loaded secrets into the module-global `_DEFAULTS`, where they remain in memory for the process lifetime unless manually cleared. This discrepancy can mislead reviewers and operators into underestimating secret retention and exposure in long-lived processes or debugging contexts.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The file introduces a reusable network downloader into a skill whose declared purpose is limited to NDVI temporal interpolation. That capability expands the attack surface by enabling retrieval of arbitrary remote content, which can be abused for unapproved data exfiltration paths, fetching untrusted inputs, or SSRF-style access if upstream callers can influence URLs. In this context, the mismatch between manifest purpose and embedded capability is itself a meaningful security concern.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
This module provides broad remote download functionality for arbitrary URLs, while the skill description does not justify network fetching as part of interpolation. Even though the implementation includes some safety features like temp files, retries, and optional SHA256 checks, it still accepts unrestricted URLs and only performs integrity validation when a hash is supplied, making it possible to ingest attacker-controlled data or reach internal resources depending on how callers expose the API. The context makes this more dangerous because the capability is out of scope for the advertised skill behavior and may bypass operator expectations.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
This file adds active place-resolution and external network geocoding behavior to a skill whose declared purpose is NDVI temporal interpolation. That capability expansion creates unnecessary data egress, enlarges the attack surface, and can enable unexpected outbound requests on user-supplied input that are unrelated to the advertised function.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The module performs requests to external geocoding services (Open-Meteo and Nominatim) despite the skill being described only as temporal interpolation for NDVI time series. Unjustified outbound connectivity can leak user-provided place names, violate least-privilege expectations, and introduce supply-chain and privacy risks through third-party services.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring presents the file as a compatibility shim, but the retained fallback implementation still contains full network geocoding logic. This mismatch can mislead reviewers and operators about the actual behavior of the module, making hidden or unexpected outbound capabilities harder to detect and govern.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Place queries are transmitted to Open-Meteo and optionally Nominatim without any disclosure in this file, which can surprise users and leak potentially sensitive location data to external services. Even if the data is not highly confidential, undisclosed third-party transmission is a meaningful privacy and security concern.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The code persists resolved queries and manifests to a cache file under the user's home directory without explicit disclosure, which can leave a local history of place lookups and derived AOIs. This is primarily a privacy issue, but on shared systems or multi-user environments it could expose sensitive operational context.

Missing User Warnings

High
Confidence
100% confidence
Finding
The file contains hardcoded fallback credentials for a real Earthdata username and password. Embedded credentials are highly dangerous because anyone with source access can reuse them, and any code path that falls back to defaults may silently authenticate to a real external account without user consent or awareness.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The Nominatim request hardcodes an Accept-Language header of zh-CN/zh without user choice. While not a direct code-execution issue, it forces locale preferences onto requests, can disclose assumptions about user context, and may produce biased or unexpected results for users outside that locale.

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
86% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
Confidence
86% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
Confidence
86% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。
Confidence
83% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
87% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
Confidence
87% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),
Confidence
89% confidence
Finding
.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
Confidence
91% confidence
Finding
~/.netrc

Credential Access

High
Category
Privilege Escalation
Content
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:
Confidence
91% confidence
Finding
.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15