ClawHub
Back to skill

Security audit

geoskill-urban-sprawl-analysis

Security checks across malware telemetry and agentic risk

Overview

The advertised tool is a local urban-sprawl analyzer, but the package also bundles undisclosed credential, web lookup, and download helpers that do not fit the offline description.

Review this package before installing. The main script appears to do local urban-sprawl analysis, but the bundle should remove or clearly disclose the credential manager, geocoder, and generic downloader; the exposed Earthdata credential should be rotated, and dependencies should be pinned. Use an isolated environment if testing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares an offline/local urban sprawl analysis workflow, but the detected capabilities include environment access, file read/write, shell, and network without any explicit permission declaration. This creates a trust and transparency gap: users may run the skill believing it is narrowly scoped while it can access local data, execute commands, and potentially communicate externally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
This is a significant description-behavior mismatch: the skill presents itself as local geospatial morphology analysis, yet the detected behavior includes credential harvesting sources (.env/.netrc/secrets), hardcoded Earthdata credentials, online geocoding/weather access, and generic HTTP download logic. Such hidden capabilities materially expand the attack surface and could expose secrets, enable unintended data exfiltration, or cause users to trust and execute code far outside the advertised purpose.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The vendored metadata shows this skill bundles a separate "landsat-download" capability that is materially broader than the declared purpose of urban sprawl metric analysis. Hidden or mismatched functionality increases supply-chain risk because it may introduce network access, data acquisition, or other behaviors users would not reasonably expect from an analysis-only skill.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The listed modules include download and credential-handling functionality despite the skill being described as a metric-analysis tool. In this context, undeclared credential and remote-download capabilities are dangerous because they expand the attack surface for secret misuse, unauthorized outbound access, or execution of unexpected data-fetch behavior.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The docstring promises ambiguous handling via returned candidates and says it will not silently pick the first result, but the implementation scores candidates and auto-selects one. In a geospatial analysis skill, this can cause silent analysis of the wrong city or region, leading to incorrect outputs and possible privacy or compliance issues if sensitive place queries are sent externally under false assumptions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The file performs unrestricted external network retrieval and writes attacker-influenced content to local paths, which exceeds the declared analysis-focused purpose of the skill. In an agent setting, this can be abused to fetch arbitrary payloads, stage files on disk, and potentially overwrite or plant artifacts in sensitive locations if higher-level inputs are not tightly controlled; integrity checking is optional, so untrusted content may be accepted by default.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The code sends user-provided place queries to external third-party services (Open-Meteo and Nominatim), creating a data egress path that is not clearly justified by the stated manifest description alone. In agent environments, even seemingly innocuous location queries can reveal sensitive user intent, targets, or investigation subjects, especially when sent automatically without explicit disclosure or consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User-supplied place queries are transmitted to external geocoding services (Open-Meteo and optionally Nominatim) without any disclosure or consent mechanism in this code. Place names can reveal sensitive user interests, locations, projects, or operational targets, so silent third-party transmission creates a real privacy and data-governance risk.

Missing User Warnings

High
Confidence
100% confidence
Finding
The source contains hardcoded fallback credentials for EARTHDATA_USERNAME and EARTHDATA_PASSWORD. Any code path that uses these defaults can silently authenticate with embedded credentials, exposing a real secret to anyone with source access and enabling unauthorized use, account abuse, or credential reuse attacks if the password is reused elsewhere. In the context of a geospatial skill, hardcoded remote-service credentials are especially inappropriate because the skill may run in diverse environments where users do not expect inherited account access.

Natural-Language Policy Violations

Medium
Confidence
72% confidence
Finding
Forcing the Accept-Language header to Chinese without user choice can leak assumptions about user locale and influence provider responses in ways the user did not request. This is primarily a privacy/quality issue rather than a direct compromise, but in some contexts it may bias returned place names or unexpectedly disclose regional preferences to the external service.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
97% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
98% confidence
Finding
scipy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
geopandas
shapely
Confidence
98% confidence
Finding
geopandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
rasterio
scipy
geopandas
shapely
Confidence
96% confidence
Finding
shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical
Category
Supply Chain
Confidence
95% confidence
Finding
geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15