Security audit
Security checks across malware telemetry and agentic risk
The main tool is an offline accuracy evaluator, but the package also ships unrelated network, credential, cache, and downloader code that is not disclosed by the skill description.
Treat this as needing review before installation. The main accuracy-assessment script appears purpose-aligned, but the package should remove or clearly split out the geocoding, downloader, credential, and home-directory cache helpers, and the exposed Earthdata password should be rotated. Install only in a constrained environment if you need to test it before those issues are fixed.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
"""env > 用户 secrets > .netrc > 默认."""
env_val = os.environ.get(env_name, "").strip()
if env_val:
return env_valdef load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy scikit-learn
numpy rasterio scipy scikit-learn geopandas
numpy rasterio scipy scikit-learn geopandas shapely
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution