geoskill-ai-training-data-annotation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:37 AM UTC
• Version: 1.0.0

Overview

The main annotation tool is mostly local and purpose-aligned, but the package also includes undisclosed credential, geocoding, downloader, and hardcoded-password code that users should review before installing.

Install only after reviewing or removing the bundled credential/geocoding/downloader helpers and rotating the exposed Earthdata credential. Run it in a restricted environment if you only need local annotation, and pin dependencies before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares itself as offline/local annotation tooling, yet the detected capabilities include network, shell, environment access, and unrestricted file read/write without corresponding permission disclosure. That mismatch weakens trust boundaries and can enable unexpected data access or command execution in hosts that rely on manifest metadata to sandbox or review skills.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a significant description-behavior mismatch: the skill is presented as a local segmentation/annotation tool, but analysis indicates additional geocoding, remote API access, downloader logic, credential management, and even hardcoded Earthdata fallback credentials. Hidden networking and embedded credentials materially expand the attack surface and can lead to secret exposure, unauthorized external access, or silent data egress.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module hardcodes a real-looking fallback username/password for NASA Earthdata inside source code. Even if framed as a fallback, embedded credentials are secrets exposure and unauthorized-account-use risk; anyone with code access can extract and reuse them, and downstream code may silently authenticate with them.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: This skill is presented as a segmentation/annotation tool, yet the credential manager is designed to resolve multiple unrelated external-service secrets, including OpenAI and other data-provider credentials. That scope expansion increases the blast radius: any later code in the skill can access a broad set of user secrets unrelated to the declared function, which is dangerous in an agent setting.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded, but the implementation includes a hardcoded default password. This mismatch is dangerous because it can mislead reviewers and users into trusting the module while a secret is actually embedded, delaying detection and response.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill behavior materially exceeds its stated scope by training a model on the fly and persisting weights beside the code, which introduces undeclared state changes and side effects. In an agent/automation setting, hidden writes outside the declared output directory can violate operator expectations, break reproducibility, and create a covert persistence mechanism even if the saved weights do not directly contain source imagery.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation claims an offline numpy-equivalent implementation without torch, but the default execution path requires torch, CUDA, and a real U-Net. This mismatch is dangerous because security controls, sandboxing decisions, and user consent may be based on the declared low-dependency/offline behavior, while the actual code executes a much heavier and different code path with additional attack surface and operational risk.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: Although the code appears to remain local, it silently writes model weights to the code directory in addition to declared outputs, contradicting the privacy/behavioral documentation. Undeclared filesystem writes are security-relevant in agent environments because they create persistence, can alter future runs, and may bypass output allowlists or auditing tied to the configured output directory.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-supplied place queries are transmitted to third-party geocoding services without any disclosure or consent mechanism in this code path. Place names can contain sensitive operational, personal, or proprietary location information, so silent transmission creates a real privacy and data-governance risk, especially in enterprise or regulated geospatial workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Resolved location queries are persisted under the user's home directory without user-facing disclosure or retention controls. This can leak sensitive search history to other local users, backups, forensic tools, or later processes, turning transient location inputs into durable artifacts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-supplied place names are transmitted to a third-party geocoding service without any visible consent, warning, or local-only default. Even if the data seems low sensitivity, place queries can reveal locations of interest, customers, operations, or internal project areas, creating avoidable privacy and operational disclosure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The fallback Nominatim lookup sends the same user-supplied place query to another external service, again without an explicit warning or consent flow. Because this is fallback behavior, users may not even realize a second provider receives the query, increasing surprise and disclosure risk.

Natural-Language Policy Violations

High

• Confidence: 93% confidence
• Finding: Hard-coding the Accept-Language header to Chinese forces locale disclosure and may influence provider-side profiling or routing without user choice. It also leaks an assumption about the operator/user context and can produce biased results or unexpected behavior for non-Chinese users.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 95% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
torch

• Confidence: 99% confidence
• Finding: torch

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: scipy

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: torch

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15