ClawHub
Back to skill

Security audit

Rs Metadata Crawler

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward satellite-metadata crawler with expected network queries and local output files, with only minor dependency and transparency caveats.

Before installing, be aware that searches contact the listed public remote-sensing services and write result or cache files locally. For stricter environments, pin the requests dependency and run the tool with explicit --output and --cache-dir paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes capabilities that inherently require network access and local file read/write operations, but no permissions are declared. This creates a transparency and policy-enforcement gap: a user or host system cannot accurately assess or constrain what the skill is allowed to do, increasing the risk of unintended data access, external requests, or unsafe execution in less-trusted environments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
Confidence
96% confidence
Finding
requests>=2.28.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:15