ClawHub
Back to skill

Security audit

Phenology Metrics

Security checks across malware telemetry and agentic risk

Overview

This skill is a local NDVI/EVI phenology analysis tool with ordinary scientific Python dependencies and no evidence of hidden network, credential, persistence, or destructive behavior.

Before installing, treat the dependency versions as flexible rather than fully reproducible; use a locked environment if you need strict scientific or production repeatability. Also verify the documented advanced options against the actual CLI, because some advertised features are not implemented in the inspected script.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
Confidence
93% confidence
Finding
numpy>=1.21.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
Confidence
93% confidence
Finding
pandas>=1.3.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
Confidence
94% confidence
Finding
scipy>=1.7.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_phenology-metrics.py:18