ClawHub
Back to skill

Security audit

Geoskill: Water Body Extraction

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its water-extraction purpose, but it repeatedly promises local-only processing while its place-name workflow can contact external services.

Install only if you are comfortable with the --place workflow potentially sending location queries, dates, and cloud-filter parameters to external services. For offline or sensitive work, use explicit local --input GeoTIFF files and avoid --place unless the publisher updates the privacy disclosure and network controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The documentation states the tool uses only local raster processing with no external API calls, but elsewhere it advertises auto-fetching scenes by place name and lists network-related failures. This mismatch can mislead users and reviewers about data egress and runtime behavior, causing unapproved network access and disclosure of user-supplied place/date parameters.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The Chinese section repeats the claim that operation is local-only and uses no external APIs, contradicting earlier content describing one-shot place-name fetching and network error conditions. Users relying on the Chinese documentation may unknowingly trigger external requests, creating privacy, compliance, and trust issues.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The file explicitly claims 'LOCAL processing only' and 'NO data is sent to any external server', but later code performs remote geocoding and can automatically fetch remote imagery. This is dangerous because users may supply sensitive place names or rely on the privacy guarantee when in fact network activity occurs, creating a trust and data-disclosure issue.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill is presented as a local raster-processing tool, yet it includes remote place resolution and automatic data acquisition capabilities. That mismatch broadens the tool's behavior beyond what users are told, which can expose user inputs and trigger unintended network access in environments expecting offline-only operation.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The fallback resolver sends the user-provided place string to the external Nominatim service. In a tool whose core function is local raster analysis, this outbound request is not obvious from the privacy messaging and can leak potentially sensitive location interests or identifiers.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
When --place is provided without --input, the command can automatically fetch remote satellite scenes, adding significant online data-acquisition behavior beyond local extraction. This can violate user expectations, trigger unexpected network traffic, and pull untrusted external data into the workflow without strong disclosure.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The CLI help repeats that 'all data' is processed locally even though the code may contact external services for geocoding and scene retrieval. Repeating a false privacy guarantee at the point of use increases the likelihood that users will unknowingly disclose information or run the tool in restricted environments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The one-shot place-name workflow implies the tool will resolve a location and fetch Sentinel-2 imagery, but it does not warn that this requires outbound network access or that the supplied place name, date range, and cloud constraints may be sent to third-party services. In a skill context, undocumented transmission of user-provided geographic queries can violate user expectations and organizational restrictions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The privacy disclosure omits that network-based place resolution and remote scene fetching may occur, so users are not clearly informed at the point of use. This is dangerous because consent is not meaningful when documentation assures the opposite of actual behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The Nominatim fallback transmits the user-supplied place name to a third-party service without a specific warning in command output. Even if the data seems low sensitivity, place queries can reveal operational interests, customer locations, or investigative targets.

Unpinned Dependencies

Low
Category
Supply Chain
Content
fiona>=1.8.0
numpy>=1.21.0
rasterio>=1.3.0
scipy>=1.7.0
Confidence
96% confidence
Finding
fiona>=1.8.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fiona>=1.8.0
numpy>=1.21.0
rasterio>=1.3.0
scipy>=1.7.0
shapely>=1.8.0
Confidence
96% confidence
Finding
numpy>=1.21.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fiona>=1.8.0
numpy>=1.21.0
rasterio>=1.3.0
scipy>=1.7.0
shapely>=1.8.0
tqdm>=4.64.0
Confidence
96% confidence
Finding
rasterio>=1.3.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fiona>=1.8.0
numpy>=1.21.0
rasterio>=1.3.0
scipy>=1.7.0
shapely>=1.8.0
tqdm>=4.64.0
Confidence
96% confidence
Finding
scipy>=1.7.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.21.0
rasterio>=1.3.0
scipy>=1.7.0
shapely>=1.8.0
tqdm>=4.64.0
Confidence
96% confidence
Finding
shapely>=1.8.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
rasterio>=1.3.0
scipy>=1.7.0
shapely>=1.8.0
tqdm>=4.64.0
Confidence
96% confidence
Finding
tqdm>=4.64.0

Known Vulnerable Dependency: fiona==1.8.0 — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical
Category
Supply Chain
Confidence
98% confidence
Finding
fiona==1.8.0

Known Vulnerable Dependency: numpy==1.21.0 — 1 advisory(ies): CVE-2021-34141 (Incorrect Comparison in NumPy)

Low
Category
Supply Chain
Confidence
74% confidence
Finding
numpy==1.21.0

Known Vulnerable Dependency: scipy==1.7.0 — 2 advisory(ies): CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy); CVE-2023-29824 (** DISPUTED ** A use-after-free issue was discovered in Py_FindObjects() functio)

High
Category
Supply Chain
Confidence
90% confidence
Finding
scipy==1.7.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low
Category
Supply Chain
Confidence
90% confidence
Finding
tqdm==4.64.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.