ClawHub
Back to skill

Security audit

Landcover Download

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed land-cover data downloader with expected network access and local file writes, with minor cautions around quiet mode and unused plain-HTTP dataset helpers.

Install only if you expect the skill to contact public geospatial data services and save potentially large raster files locally. Leave quiet mode off when you want visible network/download notices, and treat the advertised FROM-GLC and GlobeLand30 support as incomplete until the plain-HTTP helper paths are removed, secured, or clearly gated.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill allows suppression of progress and privacy notices during network downloads via `--quiet` or `LANDCOVER_DOWNLOAD_QUIET=1`, without documenting any mandatory replacement warning. This can reduce user awareness that network access is occurring and make silent data transfer easier to disguise in automated or delegated workflows.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_fromglc_url(year: int, tile_id: str) -> Optional[str]:
    """Get FROM-GLC download URL for a given year and tile."""
    base_urls = {
        2010: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2010v1/",
        2015: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2015v1/",
        2017: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2017v1/",
    }
Confidence
83% confidence
Finding
http://data.ess.tsinghua.edu.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
"""Get FROM-GLC download URL for a given year and tile."""
    base_urls = {
        2010: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2010v1/",
        2015: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2015v1/",
        2017: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2017v1/",
    }
    base = base_urls.get(year)
Confidence
83% confidence
Finding
http://data.ess.tsinghua.edu.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
base_urls = {
        2010: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2010v1/",
        2015: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2015v1/",
        2017: "http://data.ess.tsinghua.edu.cn/data/fromglc10_2017v1/",
    }
    base = base_urls.get(year)
    if not base:
Confidence
83% confidence
Finding
http://data.ess.tsinghua.edu.cn/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:25