Geoskill: GEE Dataset Intelligence

• Outcome: Pass
• Latest audit: Aug 1, 2026 · 6:58 AM UTC
• Version: 3.0.0

Overview

This skill is a disclosed Google Earth Engine catalog search and maintenance tool with optional network refresh and audit features that are explicit and user-invoked.

Installers should treat normal search as local/offline, run catalog refresh only when network access to Google sources is acceptable, use LLM audit only with an approved endpoint and API key, and avoid passing sensitive filesystem locations to --qa or --write-overrides unless intentionally maintaining the skill assets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes capabilities to read environment variables, read and write local files, and perform network operations, but no permissions are declared in the manifest. This creates a transparency and least-privilege problem: operators may invoke a skill that can update files, contact external services, and consume secrets from env vars without those capabilities being explicitly surfaced for review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is a dataset search/intelligence skill, but the file also documents catalog refresh, validation, audit, external page fetching, third-party LLM review, and local report/override writes. That mismatch increases the chance that a user or platform grants trust appropriate for a read-only lookup tool while the skill can actually perform materially broader and riskier actions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest advertises dataset intelligence over public Earth Engine data, yet the documentation includes workflows that fetch remote content, write under assets/ and reports/, and optionally send metadata to an external LLM. This discrepancy can mislead reviewers about operational scope and increase the risk of unintended data transmission or filesystem modification during use.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script can write back to `audit-overrides.json`, which changes persistent skill asset state rather than only analyzing data. Even though this behavior is gated behind explicit CLI flags and completion checks, it exceeds the stated read-oriented dataset intelligence scope and creates a path for accidental or unauthorized modification of repository data.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends catalog candidate metadata to a configurable external LLM endpoint, which is a data egress capability not clearly justified by the skill description. Because the endpoint is configurable and the transmitted payload includes titles, descriptions, providers, tags, and source URLs, this creates confidentiality and governance risk if used with unapproved services or sensitive metadata.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The --qa option allows writing a JSON sidecar to an arbitrary filesystem path supplied by the caller, which exceeds the stated read/query role of the skill and creates an unintended file-write primitive. In agent or automated environments, this can overwrite files, drop artifacts in sensitive locations, or be abused for persistence/audit-log poisoning if the path is not constrained.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The module advertises bundled-catalog inspection, but the --place feature may invoke external geocoding services via place_resolver, introducing network egress and third-party data disclosure not apparent from the top-level description. This mismatch matters in constrained or privacy-sensitive deployments where a 'local catalog query' tool may be trusted to avoid external communication.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documented behavior understates that a seemingly local catalog query can trigger network-backed place resolution, which is a form of capability expansion beyond what users may expect. In practice this can leak user-supplied place names and metadata to external providers and violate network isolation assumptions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided place names may be sent to external services (as noted in the help text: Open-Meteo + Nominatim) without a runtime warning, confirmation, or explicit consent control. This can expose sensitive location queries, organizational interests, or investigative targets to third parties, especially when the tool is run by an agent on behalf of a user.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

gee_catalog

• Confidence: 96% confidence
• Finding: The requirements file specifies the dependency `gee_catalog` without a version pin or constraint, which makes installs non-reproducible and allows future upstream releases to introduce breaking changes or, in a supply-chain scenario, malicious code. In an agent skill that processes external data and may run in automated environments, unpinned dependencies increase exposure to unintended package updates.

Static analysis

No suspicious patterns detected.