ClawHub
Back to skill

Security audit

Geoskill: 水质遥感监测

Security checks across malware telemetry and agentic risk

Overview

This skill is a purpose-aligned water-quality raster analysis tool, with disclosed local outputs and documented satellite download/cache behavior, but it should improve dependency pinning and documentation clarity.

Before installing, be aware that the documented bbox/date workflow may contact external satellite data services and store downloaded data in a local cache. Prefer running it in a controlled environment, set --cache-dir to a location you manage, and consider pinning or locking dependency versions before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The documentation states that the skill can automatically download remote satellite data and cache it locally, but it does not clearly warn users that running the command will initiate network access and write data to a persistent cache directory. In an agent or automated environment, this can lead to unexpected external communication, policy violations, or unintended storage of potentially sensitive geospatial query metadata.

Unpinned Dependencies

Low
Category
Supply Chain
Content
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
Confidence
95% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Third-party dependencies used by this skill
numpy
rasterio
Confidence
91% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Requirements for water-quality-remote-sensing
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
Confidence
94% confidence
Finding
geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.