ClawHub
Back to skill

Security audit

geoskill-volcanic-hazard-assessment

Security checks across malware telemetry and agentic risk

Overview

The advertised volcanic hazard tool is mostly local, but the package also bundles unrelated credential, network lookup, and download helpers that are under-disclosed and include a hardcoded password.

Review this package before installing. The documented CLI appears local and purpose-aligned, but the package should remove or clearly disclose the unrelated credential/geocoding/download helpers, remove and rotate the hardcoded Earthdata password, correct vendored provenance metadata, and pin dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no permissions, yet the described/runtime capabilities include environment access, file read/write, shell, and network use. This creates a dangerous trust gap: users and orchestrators may approve or sandbox the skill incorrectly, while the skill can still access local data, execute commands, or make outbound requests if the underlying implementation allows it.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is narrow volcanic hazard assessment, but the detected behavior includes credential handling with fallback secrets, reading sensitive local credential stores, geocoding/network access, and generic downloading infrastructure unrelated to the stated task. This mismatch is high risk because it can conceal credential harvesting, unintended data exfiltration, or broader system access behind an innocuous scientific skill description.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the declared volcanic hazard assessment skill, which indicates a supply-chain integrity or packaging mismatch. Even though this file is metadata rather than executable code, such inconsistency can hide accidental component substitution, stale dependencies, or intentional repackaging that causes the wrong code to be trusted and deployed.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation claims passwords are not cached, but load_user_secrets() copies secrets into the module-global _DEFAULTS dictionary and reuses them for later calls. That increases secret lifetime in process memory and can mislead reviewers or operators into believing the module has stronger secret-handling properties than it actually does.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and optionally Nominatim) over the network without any built-in disclosure, consent flow, or privacy guardrails. Place names can reveal sensitive operational interests or locations, which is especially relevant in a volcanic hazard assessment workflow where queried AOIs may correspond to sensitive facilities, field sites, or internal investigations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The module persists resolved place data to a cache file under the user's home directory by default, without any user-facing notice or retention control. This creates a local privacy leak because AOI queries and derived locations may remain on disk and be readable by other local processes, backup systems, or future users of the account.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module contains hardcoded fallback credentials, including a plaintext username and password. Hardcoded credentials are a serious secret-management failure because anyone with source access can reuse them, and the fallback behavior may silently authenticate to a live external service in deployments where environment variables are absent.

Natural-Language Policy Violations

Medium
Confidence
72% confidence
Finding
The Nominatim request hard-codes an Accept-Language header of zh-CN/zh, which silently forces locale preferences for every user. This can bias or alter returned place names and metadata, creating integrity and privacy concerns by leaking an unwarranted regional preference and reducing user control over how external services process the query.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
98% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15