Security audit

GEE Dataset Intelligence

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Google Earth Engine catalog helper with some optional network and local-write features that users should understand before enabling.

Install only if you are comfortable with explicit catalog refreshes contacting Google sources, optional audit mode sending public catalog metadata to your configured LLM provider, and --place lookups potentially using external geocoding. Avoid putting secrets in files, and consider pinning dependencies before automated deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented behavior claims local/offline querying by default, but the detected capability set includes optional online geocoding fallback and per-query sidecar writes that are not disclosed in the description. Undisclosed network fallback can transmit user-supplied place names externally, and undisclosed sidecar logging can persist sensitive query context or dataset selections without informed consent.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The credentials section understates API-key usage by saying keys are only for translation, while the audit flow elsewhere uses a separate third-party LLM API key. This inconsistency can mislead operators about when credentials are required and when public catalog metadata may be sent to an external provider, undermining informed consent and review of data egress paths.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: `resolve_place` defaults `use_nominatim=True` and may send user-supplied place text to an external geocoding service via `_geoskill_aoi.resolve_place(... allow_nominatim=True ...)` without any disclosure or explicit consent in this file. In a skill described as local/offline for catalog queries, this creates an unexpected data egress path and can leak sensitive user interests, locations, or project context.

Unpinned Dependencies

Low

Category: Supply Chain
Content: gee_catalog
Confidence: 92% confidence
Finding: gee_catalog

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_query_catalog.py:20