geoskill-ai-time-series-forecast

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:50 AM UTC
• Version: 1.0.0

Overview

The main forecasting command is mostly local, but the package also ships under-disclosed network, download, caching, and credential-handling code including a plaintext fallback password.

Review this skill before installing. The forecasting entrypoint appears local, but the package should remove or clearly split the unrelated vendored geocoding/downloader/credential modules, delete and rotate the hardcoded Earthdata credentials, document any network/cache behavior, and pin dependencies before it is treated as a normal benign install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its documented/runtime capabilities include file access, shell execution, environment access, and possible network use. This is dangerous because users and orchestrators cannot make an informed trust decision, and hidden capabilities can be abused to read local secrets, modify files, or reach external services unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as an offline/local time-series forecasting tool, but the analyzed behavior includes credential handling, reading .netrc and secrets files, built-in fallback credentials, geocoding/network requests, and download functionality unrelated to the stated purpose. This mismatch is dangerous because it can conceal sensitive data access and outbound communication under the guise of a benign forecasting workflow, increasing the risk of credential exposure, unintended data transfer, and supply-chain style abuse.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the actual forecasting skill. This creates a supply-chain integrity gap: reviewers and automation may validate or trust hashes, provenance, or expected behavior against the wrong component identity, making code substitution, stale vendored code, or accidental dependency mix-ups harder to detect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The exported resolve_place API introduces network-backed geocoding behavior that is not disclosed by the skill's stated time-series forecasting purpose. Hidden external lookups expand the skill's capabilities, create data egress risk for user-supplied locations, and make runtime behavior harder for operators to audit or sandbox appropriately.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The legacy fallback performs direct HTTP requests to Open-Meteo and OpenStreetMap Nominatim, adding undeclared third-party network communication. Even if intended for convenience, this can leak user queries externally, bypass assumptions about an offline/local forecasting skill, and create unexpected compliance and privacy exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: User-provided place names are sent to external geocoding services without any disclosure or explicit consent in this code path. Place queries can contain sensitive location information, so silent transmission to third parties creates a privacy and data-governance risk, especially in enterprise or regulated environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The helper persists user lookup data under the home directory without notice, which can leave a recoverable history of sensitive place searches on shared systems or managed endpoints. Even though the filename is hashed, the cached JSON still stores the original query and resolved location data, creating local privacy exposure.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Hardcoded secrets in source are dangerous because anyone with repository or package access can recover and misuse them, and deployed systems may silently authenticate with those credentials if local configuration is absent.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 98% confidence
• Finding: torch

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: torch

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15