ClawHub
Back to skill

Security audit

geoskill-urban-drainage-analysis

Security checks across malware telemetry and agentic risk

Overview

The main drainage-analysis tool looks mostly local, but the package also bundles under-disclosed network geocoding, downloader, credential-reading code, and a hardcoded Earthdata password.

Install only if you are comfortable with the bundled geoskill-core code, not just the documented drainage CLI. Prefer running it in a contained environment, remove or audit the credential module and hardcoded Earthdata fallback password, document or disable remote geocoding and home-directory caching, and pin dependencies before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill manifest declares no permissions, yet the documented and detected capabilities include shell, file read/write, environment access, and network use. This creates a trust and transparency problem: users and orchestrators may execute the skill under a false assumption of limited privileges, increasing the chance of unintended data exposure or unsafe execution paths.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a significant description-behavior mismatch: the skill claims to perform local urban drainage analysis, but the detected behavior includes geocoding, arbitrary HTTP downloading, credential management for multiple external services, and even hardcoded Earthdata credential fallback values. Such hidden breadth materially expands the attack surface and can enable credential leakage, unauthorized network access, or retrieval of untrusted content unrelated to the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The vendored metadata claims the bundled core belongs to the skill 'landsat-download' while this package is 'geoskill-urban-drainage-analysis'. This mismatch is a supply-chain integrity issue because it suggests code or metadata was copied from a different skill, making provenance validation, review, and update tracking unreliable; in the worst case, unrelated or stale vendored code could be silently included.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The public API exposes place-name resolution parameters and delegates to geocoding backends, but the skill metadata only describes urban drainage risk analysis. That mismatch means user inputs may be sent to third-party services without clear disclosure, creating an undeclared data-flow and privacy risk rather than a core code-execution flaw.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The legacy resolver performs outbound HTTP requests to Open-Meteo and Nominatim using user-supplied place queries. In this skill context, geocoding may support analysis, but because it is not clearly declared and transmits potentially sensitive location intent to external services, it represents a genuine external data exfiltration/supply-chain exposure.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The module can send user-supplied place names to third-party geocoding services and persist results under the user's home directory without any in-band warning at the call site. In a location-analysis workflow, place queries may reveal sensitive operational interests or user locations, so undisclosed network transmission and disk persistence create a privacy and data-governance risk even if the behavior is not overtly malicious.

Natural-Language Policy Violations

Medium
Confidence
72% confidence
Finding
Forcing the Accept-Language header to 'zh-CN,zh;q=0.9' without user choice can leak assumptions about user locale or deployment context to a third-party service and may influence service behavior in ways the user did not request. In this skill, the risk is mainly privacy and transparency-related rather than direct compromise, but it is still unnecessary ambient metadata disclosure.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module hardcodes real-looking fallback credentials (EARTHDATA_USERNAME and EARTHDATA_PASSWORD) directly in source. Hardcoded secrets are dangerous because they can be harvested from code, reused unintentionally in multiple environments, and may grant unauthorized access if valid; even if no longer valid, they normalize insecure secret handling and can leak a real user's account identity.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The Nominatim request hard-codes an Accept-Language preference for zh-CN without user choice or justification. This can bias results, create unexpected behavior for non-Chinese users, and leak an implied locale/profile to the third-party service, though the direct security impact is limited.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
98% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
98% confidence
Finding
geopandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
rasterio
scipy
geopandas
shapely
Confidence
94% confidence
Finding
shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
91% confidence
Finding
scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical
Category
Supply Chain
Confidence
88% confidence
Finding
geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15