geoskill-animated-map-series

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:38 AM UTC
• Version: 1.0.0

Overview

The skill advertises an offline map animation tool but ships undisclosed network, download, and credential-handling code, including hardcoded Earthdata credentials.

Review this skill before installing. The advertised offline animation function is coherent in the main script, but the package contains extra network, download, caching, and credential code that is under-disclosed and broader than necessary. Do not install it in an environment with sensitive ~/.netrc, ~/.geoskill/secrets.json, API keys, or private location queries unless those modules are removed or the publisher clearly scopes and documents them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet the analysis indicates capabilities for environment access, file read/write, shell, and network use. This under-declaration is dangerous because operators may approve or sandbox the skill based on incomplete expectations, allowing broader system or data access than the manifest suggests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior is a local offline raster-to-GIF renderer, but the analysis reports additional geocoding, downloading, credential handling, remote-service access, and even embedded fallback secrets. That mismatch materially increases risk because users may supply sensitive geospatial data believing processing is local-only, while hidden network and credential features could enable data exfiltration, unauthorized external access, or misuse of stored secrets.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata shows inclusion of a separate 'landsat-download' skill inside a package whose declared purpose is only animated map-series/GIF composition. That scope mismatch is dangerous because it silently expands the attack surface to network acquisition and related helper modules, increasing the chance of undisclosed data access, remote fetching, or execution paths that users and reviewers would not expect from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The presence of modules such as safe_download.py and credentials.py introduces download and credential-handling capabilities unrelated to the stated rendering-only purpose. In this context, undisclosed credential and network functionality is especially risky because it may enable secret collection, unauthorized outbound access, or abuse of privileged data sources under the guise of a visualization skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module is a centralized credential accessor that reaches into environment variables, ~/.netrc, and ~/.geoskill/secrets.json, and it also contains hardcoded fallback credentials. That materially expands the skill's access to external accounts beyond what is justified for simple raster/GIF composition, and creates a ready path for any other code in the skill to retrieve sensitive credentials. In this skill context, bundling broad credential access is more dangerous because the stated purpose does not require privileged account-management behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Exposing an OPENAI_API_KEY retrieval path in a geospatial animation skill is unnecessary privilege expansion. Even without direct exfiltration code here, providing access to unrelated API credentials increases the blast radius if any part of the skill or a dependency is compromised or behaves unexpectedly.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documentation says passwords are not cached, but load_user_secrets() writes loaded secret values into the module-global _DEFAULTS dictionary and marks them as loaded for future calls. That means secrets persist in process memory longer than claimed, which can mislead reviewers and operators and increase exposure in long-lived processes, debugging, or memory inspection scenarios.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: This file contains built-in outbound geocoding to third-party services and can transmit user-supplied place queries over the network. In a skill whose declared purpose is raster/frame/GIF composition, that creates unnecessary data egress, dependency on external services, and behavior outside the least-privilege scope, especially when queries may contain sensitive locations or operational context.

Context-Inappropriate Capability

High

• Confidence: 86% confidence
• Finding: The code directly performs requests to Open-Meteo and Nominatim, expanding the skill's capability beyond its stated animated-map-series function. That mismatch matters because hidden or undocumented network features increase the attack surface and can leak user inputs or be abused as an unexpected outbound communication path.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided place queries are sent to third-party geocoding services without any disclosure or consent mechanism in this file, which can leak sensitive locations or mission context. In an agent skill, seemingly harmless place names may encode private user intent, so silent transmission to Open-Meteo and Nominatim creates a real privacy/security issue.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The module contains hardcoded fallback credentials, including a non-empty username and password, directly in source code. Hardcoded secrets are highly dangerous because they can be extracted from the repository, reused unintentionally in other environments, and abused by anyone with code access; in a map/GIF skill they are especially unjustified.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 97% confidence
• Finding: matplotlib

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scipy
matplotlib
geopandas
shapely

• Confidence: 97% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15