ClawHub
Back to skill

Security audit

geoskill-wildfire-spread-modeling

Security checks across malware telemetry and agentic risk

Overview

The main wildfire simulator appears local, but the package also includes undisclosed downloader, geocoder, and credential-handling code with hardcoded credentials, so it should be reviewed before installation.

Install only after reviewing or removing the vendored geoskill core pieces that are unrelated to wildfire modeling, especially credentials.py, safe_download.py, and network geocoding. Rotate the embedded Earthdata credentials if they are real, pin dependencies, and do not use this package in sensitive environments unless third-party geocoding and local credential access are disabled or clearly controlled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a serious description-behavior mismatch if accurate: a wildfire simulation skill should not also include geocoding, generic downloaders, credential harvesting from environment/.netrc/secrets files, or hardcoded NASA Earthdata credentials. Hidden credential access and unrelated network/download functionality materially expand the attack surface and can enable secret exfiltration or unauthorized remote access under the guise of benign geospatial processing.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The vendored component is identified as a different skill, 'landsat-download', which does not match the declared wildfire spread modeling purpose. That mismatch indicates unnecessary bundled functionality and raises supply-chain and hidden-capability concerns, especially because unrelated code can introduce unreviewed behaviors not expected by users of this skill.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The vendored files include download and credential-handling modules despite the skill being described as a wildfire spread simulator. Unnecessary network and credential capabilities expand the attack surface and could enable secret access, exfiltration, or unauthorized external communication if the bundled code is invoked directly or indirectly.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The module sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which creates a data-disclosure surface that is not apparent from the wildfire-modeling description alone. In this skill context, AOI resolution is functionally relevant, but undisclosed outbound requests can expose sensitive locations or operational interests and may violate user expectations or deployment policy.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The code persists query-derived AOI results under the user's home directory, creating local retention of potentially sensitive place searches without clear disclosure. While this is not remote code execution, it can leak location interests or operational history to other local users, backups, or later processes on shared systems.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This file implements a reusable generic downloader that can fetch arbitrary remote URLs and write them to disk, which exceeds the stated wildfire-spread-modeling purpose and expands the skill's capability surface. Even though it includes safeguards like temporary files, retries, and optional hash checks, the main risk is capability creep: a modeling skill can now be used as a general network retrieval primitive for unreviewed content, data exfil staging, or retrieval of attacker-controlled inputs.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The `_http_get` helper supports unrestricted HTTP(S) GET requests via either `requests` or `urllib`, with caller-controlled URLs and headers, making it a generic remote fetch mechanism unrelated to the narrow declared purpose. In the context of a skill that is described only as wildfire spread simulation, this creates an unnecessary network primitive that can ingest attacker-controlled content or be repurposed for unauthorized external access.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
User-entered place queries are transmitted to third-party services without any disclosure in this file, which is a privacy and transparency issue. In wildfire-spread modeling, queried locations may correspond to sensitive incident areas, infrastructure, or planned operations, making silent transmission more concerning than in a generic consumer geocoder.

Missing User Warnings

High
Confidence
99% confidence
Finding
The module contains hardcoded fallback credentials, including a cleartext Earthdata username and password, directly in source code. Embedded secrets are a real vulnerability because anyone with repository or package access can recover and reuse them, and downstream users may unknowingly authenticate with shared credentials.

Natural-Language Policy Violations

Medium
Confidence
77% confidence
Finding
The Nominatim request hard-codes an `Accept-Language` header of `zh-CN,zh;q=0.9`, overriding user or system preference. This can disclose linguistic/geographic assumptions to the external service and may produce biased or unexpected results, which is a privacy and correctness concern when handling user-supplied place queries.

Credential Access

High
Category
Privilege Escalation
Content
_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",
Confidence
97% confidence
Finding
secrets.json

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
94% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
94% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
rasterio
scipy
Confidence
96% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding
scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15