geoskill-atmospheric-correction

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:16 PM UTC
• Version: 1.0.0

Overview

The main tool appears to do local atmospheric correction, but the package also bundles under-disclosed network geocoding, persistent location caching, and credential-handling code including hardcoded Earthdata credentials.

Review this package before installing in sensitive environments. The main correction script appears local, but the package should remove or clearly isolate unused network and credential helpers, delete and rotate the hardcoded Earthdata credentials, document any geocoding/cache behavior, and correct vendored provenance metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions while the associated capability set includes environment access, file read/write, shell execution, and network access. Even if some of these are only auxiliary library capabilities, failing to disclose them breaks least-privilege expectations and can mislead users into running a skill with broader access than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: There is a substantial mismatch between the narrowly described atmospheric-correction purpose and the broader detected behaviors, including geocoding, generic downloading, credential handling, reading local secrets files and .netrc, and access to multiple external services. This hidden functionality materially increases the attack surface and could expose sensitive local credentials or transmit data off-host contrary to the privacy claims in the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the skill being audited ('geoskill-atmospheric-correction'). This is a supply-chain integrity problem because reviewers, tooling, or packaging logic may trust incorrect provenance and fail to notice that the wrong dependency set was copied or substituted.

Context-Inappropriate Capability

High

• Confidence: 87% confidence
• Finding: The code sends user-supplied place queries to external geocoding services, which creates an undisclosed data egress/privacy risk unrelated to the stated atmospheric-correction purpose. In a skill presented as local imagery correction, unexpected network transmission can expose sensitive AOI names, project locations, or analyst interests to third parties.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module persists cached AOI query results under the user's home directory, creating residual sensitive data storage that users may not expect from an image-correction tool. Place names and derived manifests can reveal locations of interest and remain accessible to other local processes or future users of the same account.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation claims passwords are not hardcoded in skill source, yet the module embeds default Earthdata credentials in code. Hardcoded credentials are dangerous because anyone with source access can recover them, reuse them, and potentially access the associated external account or data services without authorization.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements place-name geocoding and AOI resolution, which is materially outside the stated purpose of an atmospheric-correction skill that should primarily transform imagery radiometry. In a skill context, unexplained scope expansion is dangerous because it adds network-capable data handling that can transmit user-supplied locations to external services and increases the attack surface without clear necessity.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-provided place queries to Open-Meteo and OpenStreetMap Nominatim over the network, even though external geocoding is not justified by the advertised atmospheric-correction function. This creates a privacy and data-exfiltration risk: AOI/place names may reveal sensitive locations, and the unnecessary outbound network behavior broadens supply-chain, logging, and dependency exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User place queries are written to persistent cache files without any visible disclosure in this file, creating a privacy and local data-retention issue. Sensitive operational locations may be recoverable from disk long after processing completes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code transmits user-provided place names to external services without evident user-facing disclosure in this module. For geospatial workflows, AOI names can be sensitive and reveal mission intent, making silent exfiltration to third parties a meaningful privacy/security concern.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: These Nominatim requests both send user queries to an external service and force a specific locale header without user awareness. The main risk is undisclosed external transmission of potentially sensitive AOI data; the forced locale also reduces transparency and user control over request metadata.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The fallback username and password appear to be real credentials and are directly embedded in the repository. This creates immediate secret exposure, enables unauthorized account use, and encourages insecure deployment patterns where software silently authenticates using shared embedded credentials.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN, which overrides user/environment preferences and can leak an implicit locale bias to the external service. While not code-execution dangerous, it is a privacy and policy issue because it sends unnecessary metadata and may affect returned results in ways the user did not request.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.22.0
rasterio>=1.3.0

• Confidence: 94% confidence
• Finding: numpy>=1.22.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.22.0
rasterio>=1.3.0

• Confidence: 94% confidence
• Finding: rasterio>=1.3.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:17