ClawHub
Back to skill

Security audit

geoskill-traffic-flow-estimation

Security checks across malware telemetry and agentic risk

Overview

The traffic estimator itself is mostly local, but the package ships under-disclosed geocoding, download, and credential-management code, including a hardcoded Earthdata login.

Review this package before installing. The main traffic-estimation command appears to process local or synthetic imagery, but the shipped helper code has broader authority than the documentation says. Do not rely on the embedded Earthdata credentials, avoid entering sensitive place names unless remote geocoding is acceptable, and prefer a version with the unused credential/download helpers removed, dependencies pinned, and vendored metadata corrected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation declares an offline/local traffic-estimation workflow, yet static analysis detected capabilities for environment access, file read/write, shell execution, and network use without any declared permissions. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately assess what the skill may access, increasing the risk of unexpected data access or command execution if the implementation is invoked.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrowly scoped to traffic flow estimation from local or synthetic imagery, but the analyzed behavior reportedly includes unrelated geocoding, remote downloads, credential handling for multiple third-party services, and even hardcoded fallback credentials. That mismatch is dangerous because it hides a much broader attack surface than users would expect, enabling secret exposure, unauthorized outbound access, and misuse of external services under the cover of a benign geospatial skill.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The vendored core metadata identifies the embedded core as belonging to a different skill ('landsat-download') than the declared traffic-flow-estimation skill. This inconsistency can break provenance and integrity checks, mislead reviewers about what code was imported, and hide accidental or unauthorized reuse of another skill's core components. In a geospatial skill that may perform downloads or data access, incorrect vendoring metadata makes supply-chain review and trust decisions less reliable.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code sends user-supplied place names to Open-Meteo and Nominatim without any disclosure or consent mechanism in this file. Place queries can contain sensitive location information, so silent transmission to third parties creates a privacy and data-governance risk, especially in workflows that users may assume are local or offline-first.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Resolved place data is written to a predictable cache directory under the user's home folder without notice or consent. This can persist sensitive location history on disk beyond the current session, increasing exposure to other local users, backups, or forensic recovery.

Missing User Warnings

High
Confidence
100% confidence
Finding
This file contains hardcoded fallback credentials, including a plaintext Earthdata username and password, directly in source. Embedded credentials are dangerous because anyone with repository or package access can recover and reuse them, and downstream users may unknowingly authenticate as a shared account, causing account compromise, abuse, or billing/data-access exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and Nominatim) over the network without any explicit consent, warning, or local-only alternative in this file. Even if the input is 'just a place name,' it may contain sensitive locations or operational context, creating a privacy and data-sharing risk outside the user's expectations.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The request hard-codes an Accept-Language preference of 'zh-CN,zh;q=0.9' for Nominatim without user choice, which can unexpectedly steer results, leak locale assumptions, and create privacy/fingerprinting signals. While not severe on its own, it overrides user neutrality and may produce region-biased behavior inconsistent with caller intent.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
92% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15