ClawHub
Back to skill

Security audit

geoskill-urban-ventilation-corridor

Security checks across malware telemetry and agentic risk

Overview

The advertised ventilation tool is mostly local, but the package also includes under-disclosed network, downloader, credential, and provenance-mismatched modules that do not fit the stated offline purpose.

Review this package before installing. The advertised CLI appears to run local ventilation analysis, but the distributed files include unrelated geocoding, download, and credential-management code. Install only in an environment where access to ~/.netrc, ~/.geoskill/secrets.json, and home-directory cache files is acceptable, and prefer a cleaned package that removes unused credential/download helpers and documents any network geocoding behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is a local urban ventilation analysis skill, yet the associated behavior reportedly includes network geocoding, downloading, secret access, .netrc reading, and even hardcoded default credentials for unrelated external services. That mismatch is a serious red flag because it can hide credential harvesting, unauthorized outbound access, or supply-chain style abuse behind an innocuous geospatial description.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The vendored metadata declares the embedded core as belonging to a different skill ('landsat-download') than the surrounding package, which breaks provenance and trust assumptions for the vendored component. This can cause reviewers and tooling to validate the wrong artifact, masking supply-chain mixups or accidental inclusion of code and hashes from an unrelated skill.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The identity contradiction across the metadata block indicates inconsistent packaging or provenance data for vendored core files. Even without direct code execution, such contradictions weaken integrity guarantees and can enable an attacker or careless maintainer to hide substituted components behind misleading metadata.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The AOI resolver sends user-supplied place names to third-party geocoding services and also persists derived results locally, which expands the skill's data exposure beyond pure offline morphology analysis. In a geospatial workflow, place names can still be sensitive operational context, so undisclosed external transmission and persistence create a real privacy and data-governance risk even if the implementation is not overtly malicious.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
The function accepts arbitrary URLs and writes downloaded content to caller-controlled paths, which expands the skill's capability beyond its stated analytical role and can enable SSRF-style network access, untrusted content retrieval, or misuse as a generic fetch primitive. In an agent setting, this becomes more dangerous because downstream components may supply attacker-influenced URLs, and SHA256 verification is optional rather than enforced.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code transmits raw user-provided place queries to Open-Meteo and optionally Nominatim without any warning or consent mechanism in this file. Even seemingly simple location queries may reveal private interests, project sites, or sensitive areas of analysis, so silent outbound transmission is a legitimate privacy/security issue.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The module writes cached query results under the user's home directory, creating persistent local artifacts of searched locations without disclosure. Those artifacts can leak sensitive location intent to other local users, backups, endpoint monitoring tools, or later forensic review.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
Hard-coding Chinese language/locale preferences for geocoding and Nominatim Accept-Language can disclose user regional assumptions and force data handling choices without opt-in. While lower severity than the undisclosed network calls themselves, it is still a privacy and policy concern because it silently shapes outbound requests and returned data.

Missing User Warnings

High
Confidence
100% confidence
Finding
The module hardcodes a real-looking Earthdata username and password as fallback credentials, which creates immediate risk of secret exposure, unauthorized account use, and accidental propagation into downstream environments. In the context of a geospatial analysis skill, there is no justification for shipping live fallback credentials inside source code, making this substantially more dangerous than a mere example placeholder.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The code sends raw user-provided place queries to third-party geocoding services without any disclosure, consent flow, or local warning in this file. Even though a place name is usually low-sensitivity data, it can reveal user interests, location intent, or operational context, and the transmission occurs automatically during resolution.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The request hard-codes an Accept-Language header of zh-CN, which alters outbound metadata without user choice and may disclose inferred locale, target region, or deployment assumptions to the external service. In some environments this can affect privacy, produce biased results, or create policy/compliance issues because the code imposes a regional preference not derived from explicit user input.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
shapely
Confidence
95% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
shapely
Confidence
95% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
shapely
Confidence
94% confidence
Finding
shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
88% confidence
Finding
numpy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15