ClawHub
Back to skill

Security audit

ArcGIS Agent

Security checks for vulnerabilities and agentic risk

Overview

This ArcGIS skill is purpose-aligned, but it exposes a powerful unauthenticated local service that can modify GIS files and use active ArcGIS portal authority.

Install only if you are comfortable running a local ArcGIS automation server. Before use, restrict INCLUDE_MODULES to the specific toolboxes you need, add authentication or keep the port inaccessible to browsers and untrusted local processes, disable overwriteOutput by default, and avoid running it while signed into sensitive Portal or ArcGIS Online accounts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/server.py:146
Finding

Unauthenticated Local ArcPy Service Can Be Invoked by Untrusted Websites or Local Processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/server.py:110
Finding

Path Whitelist Can Be Bypassed Through Traversal, Nested Values, and Unsupported Resource Forms

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
| indoors / indoorpositioning | 22/8 | Indoor GIS / positioning | Indoors |
| maritime / bathymetry | 22/8 | S-57 charts, bathymetry | Maritime |
| ca / td / intelligence | 13/19/18 | Crime analysis / territory design / intelligence | respective ext. |
| rm / oi / reviewer / wmx / transit / geoai | 14/6/5/18/8/12 | Ortho mapping / oriented imagery / QA / workflow / GTFS / GeoAI | respective ext. |

**Portal / Enterprise modules** (calls require an active Portal or ArcGIS Online sign-in): `ra`, `geoanalytics`, `gapro`, `sfa`, `agolservices`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
| indoors / indoorpositioning | 22/8 | Indoor GIS / positioning | Indoors |
| maritime / bathymetry | 22/8 | S-57 charts, bathymetry | Maritime |
| ca / td / intelligence | 13/19/18 | Crime analysis / territory design / intelligence | respective ext. |
| rm / oi / reviewer / wmx / transit / geoai | 14/6/5/18/8/12 | Ortho mapping / oriented imagery / QA / workflow / GTFS / GeoAI | respective ext. |

**Portal / Enterprise modules** (calls require an active Portal or ArcGIS Online sign-in): `ra`, `geoanalytics`, `gapro`, `sfa`, `agolservices`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill exposes network and environment-dependent capabilities but does not declare an explicit tool scope such as allowed tools or permissions. That increases the chance an orchestrator or user invokes the skill in broader contexts than intended, especially since it can trigger local HTTP requests and launch a local Python server tied to ArcGIS Pro.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation text is very broad ('use when the user asks for GIS/spatial analysis, ArcGIS automation, or arcpy operations'), which can cause the skill to activate for many generic requests. In this skill, overbroad activation is more dangerous because activation can lead to file-writing geoprocessing operations and local service interaction without clear user intent boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Step 1 — make sure the server is running

bash
curl -s http://127.0.0.1:8765/health
# {"status":"ok","server":"arcpy-mcp-server","version":"2.1","tools":2500,"modules":46}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The examples demonstrate POST /call operations that write output datasets before clearly foregrounding overwrite and write-target risks. Because the skill can create or modify GIS outputs on disk through powerful geoprocessing tools, insufficient upfront warnings may lead to unintended data alteration or destructive writes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

第一步：确保服务在运行

bash
curl -s http://127.0.0.1:8765/health
# {"status":"ok","server":"arcpy-mcp-server","version":"2.1","tools":2500,"modules":46}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents all user prompts, AI actions, and replies exclusively in Chinese, including the title and every example interaction. Because no opt-in, alternative language option, or region-specific justification is provided, this constitutes a natural-language locale policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The server registers portal- and enterprise-facing toolboxes such as ra, geoanalytics, gapro, sfa, and agolservices even though the skill is described as a local ArcGIS Pro HTTP API. This expands the trust boundary from local geoprocessing into remote service/portal actions, potentially enabling unintended access to organizational content, publishing workflows, or remote data processing if the host is signed into ArcGIS Enterprise or ArcGIS Online.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTTP API permits remote execution of powerful ArcPy tools without any user warning, confirmation, authentication, or operation-class gating. Because many ArcPy tools can delete, overwrite, publish, transform, or exfiltrate data, a local or proxied caller can trigger impactful actions silently, which is especially risky in an agent skill intended for natural-language automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The /call endpoint executes any registered ArcPy tool with caller-supplied arguments and globally enables overwriteOutput=True, allowing remote creation, modification, and replacement of datasets. In this skill context, that is more dangerous because ArcPy includes many destructive and administrative geoprocessing tools, so the implementation exceeds a narrow 'analysis' interface and becomes a broad remote automation surface over local GIS data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The top-level natural-language description is written only in Chinese and presents the skill as such without any indication that users can choose another language or locale. Under the language/locale policy, a skill should not impose a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/server.py (reported line 77)May include surrounding context.

python
continue
    if mod_name not in INCLUDE_MODULES:
        continue
    m = getattr(arcpy, mod_name)
    tools = [t for t in dir(m) if not t.startswith('_') and t[0].isupper()]
    
    for func_name in tools:

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/server.py (reported line 83)May include surrounding context.

python
for func_name in tools:
        tool_id = f"{mod_name}_{func_name}"
        try:
            func = getattr(m, func_name)
            # Basic schema: just accept **kwargs
            TOOL_REGISTRY[tool_id] = {
                "module": mod_name,

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/server.py (reported line 173)May include surrounding context.

python
arcpy.env.overwriteOutput = True
            t0 = time.time()
            
            mod = getattr(arcpy, tdef["module"])
            func = getattr(mod, tdef["func"])
            
            # Parse kwargs: handle both flat args and JSON string kwargs

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/server.py (reported line 174)May include surrounding context.

python
t0 = time.time()
            
            mod = getattr(arcpy, tdef["module"])
            func = getattr(mod, tdef["func"])
            
            # Parse kwargs: handle both flat args and JSON string kwargs
            if "__kwargs" in args and len(args) == 1:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

After tool execution, the server inspects output paths and returns metadata such as feature counts, geometry type, raster dimensions, and result strings over HTTP. This transmits local system or dataset-derived information to API clients, but the file does not provide a visible warning or explanatory disclosure about that behavior.

Content

No source excerpt is available for this finding.