Gee Dataset Intelligence

• Outcome: Review
• Latest audit: Jul 27, 2026 · 3:46 AM UTC
• Version: 1.0.7

Overview

The skill is mostly a GEE catalog lookup tool, but it bundles hardcoded credentials and under-disclosed credential and place-resolution behavior that needs review before installation.

Install only after reviewing or removing `_geoskill_core/credentials.py`, rotating the exposed Earthdata password, and confirming whether online place lookup and home-directory caching are acceptable for your use. Ordinary catalog searches should be treated as local, but avoid using place-resolution or optional audit/update network features unless you intend to send the documented data to those services.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose is a narrow offline-first GEE catalog skill, but the finding indicates substantially broader hidden behavior, including hardcoded credential management with default username/password fallback and arbitrary external downloading. That mismatch is dangerous because operators may grant trust and permissions appropriate for a harmless catalog tool while the implementation can access external services, handle secrets, and perform unrelated networked actions outside user expectations.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The credentials section says the optional API key is only for translation, while the documented operational path uses a separate audit LLM flow. Misstating secret usage is security-relevant because users may provide credentials under a narrower trust assumption than the code actually uses, which can lead to unintended third-party data transmission or overly broad secret exposure.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The module persistently writes AOI query results to a cache directory under the user's home directory, which extends the skill's effective data-handling behavior beyond a purely local/offline lookup helper. Even though the cached content is not highly sensitive by itself, place queries can reveal user interests or locations, and the persistence is not clearly surfaced in the stated skill scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Normal place resolution can send user-supplied place names to Open-Meteo and optionally Nominatim, which contradicts the skill description that local queries are offline and that external fetches are limited to explicitly invoked refresh/audit flows. This creates an undisclosed third-party data egress path for potentially sensitive location queries and expands the trust boundary to external services.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: This credential module is over-scoped for a skill described as an offline/public GEE dataset catalog tool: it includes access paths for Earthdata, FIRMS, CMA, EOG, and OpenAI credentials. Broad credential-handling capability increases attack surface and enables a seemingly low-risk catalog skill to access unrelated user secrets if other code paths invoke these helpers, which is especially concerning in an agent/skill environment.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring states passwords are not cached, but `load_user_secrets()` loads secrets into the module-level `_DEFAULTS` dictionary and retains them in process memory. This is a security-relevant documentation mismatch because operators may rely on the stated non-caching behavior when assessing exposure in long-lived agent processes.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The code unconditionally sets Accept-Language to Chinese for Nominatim requests, overriding user locale expectations and potentially causing silent data disclosure about language or regional assumptions to a third party. In this skill context the primary issue is undisclosed request shaping rather than severe exploitation, but it still weakens user control and transparency.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`) directly in source. Embedded credentials are a severe secret-management failure: anyone with source access can reuse them, and any code path that falls back to defaults silently authenticates with a bundled account.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: When a place is not found locally, the function may send the user-supplied place string to an external geocoding service through `_geoskill_aoi.resolve_place(... allow_nominatim=True ...)` without any warning or consent mechanism in this file. In a skill described as primarily offline/local for catalog queries, this can unexpectedly disclose user-provided locations or sensitive research targets to a third party.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

gee_catalog

• Confidence: 95% confidence
• Finding: gee_catalog

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_query_catalog.py:20