geoskill-archaeology-site-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:37 AM UTC
• Version: 1.0.0

Overview

The documented tool is an offline archaeology raster analyzer, but the package also includes unrelated network and credential-handling helpers that are not disclosed by the skill instructions.

Treat this as a Review install: the core CLI looks locally scoped, but install only if you are comfortable with the extra bundled geocoding, download, and credential modules. Prefer a cleaned package that removes the unused credential helper, removes hardcoded credentials, documents any network behavior, and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill declares no permissions, yet the associated capability profile indicates access to environment variables, filesystem, network, and shell. This creates a transparency and least-privilege problem: users may invoke what appears to be an offline geospatial analysis skill while it can read local data, write files, access secrets from the environment, and make outbound connections. In a skill context, hidden capabilities materially increase risk even if no direct exploit is shown in this markdown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The described behavior is a local archaeological detection workflow, but the analysis reports substantially broader functionality including geocoding, HTTP download logic, credential handling for multiple external services, and even hardcoded fallback credentials. That mismatch is dangerous because it can conceal unexpected data exfiltration paths, broaden attack surface, and embed secrets misuse under the guise of a benign offline remote-sensing tool. The presence of hardcoded credentials especially elevates this beyond a mere documentation issue.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The vendored metadata declares a different skill, 'landsat-download', inside an archaeology site detection package. This supply-chain or packaging mismatch is dangerous because it can conceal unintended capabilities, cause the wrong code to be trusted, and defeat reviewer assumptions about what the skill is supposed to do; while the file alone does not prove malicious behavior, the inconsistency is a credible integrity issue.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The docstring claims passwords are not cached, but `load_user_secrets()` copies secrets from disk into the process-wide `_DEFAULTS` dictionary and retains them for the process lifetime unless cleared. This discrepancy can mislead reviewers and operators about memory exposure and increases the chance secrets remain accessible longer than intended in a long-lived agent process.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file implements place-name resolution and network-backed geocoding logic that is broader than the stated archaeological site detection purpose. Capability mismatch is dangerous because it introduces undeclared data egress and external dependency behavior, making it easier for a skill to collect or transmit user-supplied locations under the guise of a different function.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code makes direct HTTP requests to public geocoding services (Open-Meteo and Nominatim) using user-supplied place names. In this skill context, that creates unnecessary external data exposure and a covert egress channel not justified by the stated archaeology-detection function, with additional risks from third-party dependency, logging, and availability behavior.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15