geoskill-air-quality-dispersion

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:37 AM UTC
• Version: 1.0.0

Overview

The main simulator appears locally focused, but the package also contains under-disclosed network, geocoding, caching, and credential-handling code that does not fit the advertised offline purpose.

Review this before installing, especially on machines with ~/.netrc, ~/.geoskill/secrets.json, or sensitive project locations. The advertised simulator may run offline through its main script, but the package contains extra geospatial helper code that can use network geocoding, local caches, and local credential sources if invoked.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill declares itself as an offline local Gaussian plume simulator, but the detected capabilities include network, shell, environment access, and file read/write without corresponding permission declarations. This mismatch weakens transparency and sandboxing expectations, and can enable unexpected data access or command execution if the underlying skill implementation actually uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow and offline, but the detected behavior includes geocoding, network download tooling, credential management for multiple external services, and even hardcoded default credentials. This is dangerous because it suggests the skill may exfiltrate data, access remote services beyond user expectations, or expose embedded secrets, all under the cover of an innocuous environmental modeling description.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the surrounding air-quality dispersion skill. This supply-chain/integrity mismatch can cause reviewers and tooling to validate the wrong component provenance, increasing the risk of shipping incorrect or malicious vendored code under misleading metadata.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The resolver sends user-provided place queries to Open-Meteo and Nominatim without any disclosure or consent mechanism in this module. In a geospatial workflow, place names can reveal sensitive project locations, operational sites, or user interests, creating an avoidable privacy and data-governance leak to third parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module persists resolved place queries and manifests under the user's home directory without user-facing disclosure or consent. Cached AOIs can expose sensitive locations to other local users, backup systems, forensic review, or later unrelated processes, especially on shared or managed machines.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete Earthdata username and password. Shipping embedded credentials in source code is dangerous because anyone with repository or package access can recover and reuse them, and downstream code may silently authenticate with those secrets without user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15