geoskill-ai-report-generator

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:35 AM UTC
• Version: 1.0.0

Overview

The advertised tool is an offline report generator, but the package also ships under-disclosed credential, network lookup, and downloader code that users would not reasonably expect.

Review before installing. The documented report command appears local-only, but the package contains extra reusable modules with network access, downloader capability, credential discovery, hardcoded fallback credentials, and home-directory caching. Install only if you trust the publisher and are comfortable with those bundled capabilities, or remove/split the unrelated modules before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (50)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares itself as an offline report generator, yet the detected capabilities include shell, file read/write, environment access, and network without any explicit permission declaration. This creates a trust and review gap: users may run the skill believing it is low-risk while it can access local data and external resources, increasing the chance of unintended data exposure or unsafe execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose says the skill is an offline JSON-to-report generator, but the behavior summary indicates credential handling, secret discovery from environment and dotfiles, online geocoding/weather access, HTTP download logic, and broader GeoTIFF processing. This mismatch is dangerous because it can mislead users into supplying or running a supposedly offline/report-only skill that actually touches secrets, the network, and additional datasets, materially expanding the attack surface and risk of credential leakage or unauthorized external access.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata claims the embedded component belongs to a different skill ('landsat-download') than the declared report-generator purpose. This provenance mismatch undermines supply-chain integrity and strongly suggests the package contents may not match the expected trust boundary, which is especially risky when the vendored set includes unrelated operational modules.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: An offline report-generation skill should not need download-, sensor-, or credential-related modules, so their presence indicates unnecessary capability expansion and possible hidden behavior. Even without code execution shown in this file, bundling these modules increases the attack surface and creates a plausible path for unauthorized network access, data retrieval, or credential handling contrary to the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The module’s documented behavior and implementation include online geocoding and local disk caching, which materially exceed the declared skill purpose of offline JSON/HTML/Markdown report generation. In a security review, undeclared network egress and persistence are dangerous because they can leak user-supplied place queries to third parties and write derived data into the user’s home directory without clear consent.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This file contains external geocoding against Open-Meteo and Nominatim even though the skill is described as an offline report generator. The mismatch increases risk because user input is transmitted outside the local environment to third-party services, creating privacy and compliance exposure that users would not reasonably expect from the stated capability.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code defines a default cache path in the user’s home directory for query-derived data, which is outside the expectations for an offline report-template generator. Persisting location queries can create a privacy trail, surprise users, and expose sensitive project context to other local users or backup/sync systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements broad credential discovery and access logic for Earthdata, FIRMS, CMA, OpenAI, EOG, user secrets files, and .netrc, which is materially inconsistent with a skill described as an offline report generator. That mismatch increases the likelihood of unnecessary secret exposure and covert expansion of privilege, because the module grants access to credentials unrelated to the stated report-generation purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: An offline JSON-to-HTML/Markdown report generator has no apparent need to read ~/.geoskill/secrets.json, ~/.netrc, environment API keys, or service credentials. Unjustified secret access violates least privilege and creates a path for credential harvesting or accidental reuse of powerful tokens by unrelated code in the skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module adds full network file-download capability, including retries, resume support, and arbitrary URL fetching, which is materially outside the declared scope of an offline report-generation skill. In a skill ecosystem, unnecessary downloader functionality expands the attack surface and can be abused to fetch untrusted payloads, exfiltration helpers, or staged content at runtime, undermining review assumptions based on the manifest.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code provides generic HTTP download functionality for arbitrary URLs despite the skill being described as an offline report generator. Even though the implementation includes some safety features such as atomic writes and optional SHA256 checks, the core issue is unjustified network capability: optional integrity checks and unrestricted destinations/URLs still permit retrieval of attacker-controlled content and enable behavior inconsistent with the advertised skill purpose.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata describes offline report generation, but this module exposes online place-resolution behavior and accepts parameters that enable external geocoding. That mismatch expands the skill’s effective capabilities beyond what an integrator or user would reasonably expect, creating a data egress and trust-boundary violation if report inputs are sent to third-party services.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The legacy resolver actively performs HTTP requests to Open-Meteo and Nominatim, which is inconsistent with an offline report generator and can transmit user-supplied place names to external providers. In a security review, unjustified outbound network access is dangerous because it enables silent exfiltration, dependency on untrusted external responses, and operational behavior not disclosed by the skill’s stated purpose.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring emphasizes unified delegation and compatibility fallback, but the fallback still includes active network geocoding behavior. This is dangerous because the documentation frames the file as an adapter shim while concealing that failures in the preferred path can still trigger outbound network access, reducing reviewer and operator awareness of the true attack surface.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module writes query-derived manifests to a cache file under the user’s home directory without any user-facing disclosure in this file. Place names and AOI metadata may reveal sensitive locations, interests, or project targets, so undisclosed persistence creates a meaningful privacy and auditability risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User-supplied place queries are sent to Open-Meteo without any user-facing warning or consent flow in this module. Even if the data seems low sensitivity, geographic queries can disclose personal, commercial, or investigative context to external services and may violate offline-only or data-handling expectations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Nominatim fallback sends user place queries and locale-related headers to a third party without user-facing disclosure. This compounds privacy risk because fallback behavior may be less visible to users than the primary path, yet still exposes the same sensitive query context externally.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The module contains real-looking hardcoded fallback credentials for EARTHDATA_USERNAME and EARTHDATA_PASSWORD. Hardcoding credentials in source is dangerous because anyone with code access can recover and misuse them, and the values may silently authorize network access in environments where operators believe the skill is offline or unconfigured.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The Nominatim request forces an Accept-Language of zh-CN without user choice or justification. While not a direct code-execution issue, it can cause privacy leakage about expected locale, alter returned results in ways the user did not request, and create surprising behavior inconsistent with transparent data handling.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15