geoskill-band-ratio-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:40 AM UTC
• Version: 1.0.0

Overview

The advertised raster-analysis tool mostly does local calculations, but the package also includes under-disclosed credential, geocoding, download, and home-directory cache code that does not fit that purpose.

Review this before installing. The documented command appears to run local raster calculations, but the package also ships code that can access local credential stores, use hardcoded Earthdata credentials, contact geocoding services, download files, and write a place lookup cache. Install only if you trust the publisher and are comfortable with those extra bundled capabilities; otherwise request a narrowed package that removes unused credential, geocoding, and download modules and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 73% confidence
• Finding: The skill documentation declares no permissions, yet the referenced behavior/capabilities include environment access, file read/write, shell use, and network access. This creates a transparency and trust problem: users may run the skill believing it is local/offline while it can access sensitive resources and external services. In a skill ecosystem, undeclared capabilities can lead to unintended data exposure or command execution surfaces.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform spectral index calculation, but the analyzed behavior includes credential harvesting locations (.netrc, environment variables, secrets files), hardcoded Earthdata fallback credentials, online geocoding/weather lookups, downloading, and broad metadata utilities. Such hidden or undocumented functionality expands the attack surface and can expose secrets, trigger unexpected network exfiltration, or cause users to trust a tool with capabilities unrelated to its stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored core metadata declares the skill as 'landsat-download', which does not match the stated purpose of this skill as band-ratio analysis. That mismatch is a supply-chain integrity warning because operators may believe they are running analysis-only code while actually shipping code associated with acquisition/download behavior, increasing the chance of hidden capabilities or incorrect trust assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The vendored file list includes modules such as safe_download.py and credentials.py, which imply network access and credential handling in a skill described as performing local spectral-index calculations. In this context, those extra capabilities are not clearly justified and broaden the attack surface by enabling secret access or external data transfer if the bundled code is invoked intentionally or accidentally.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This module adds broad credential-management capability for multiple remote services to a skill whose declared purpose is local spectral-index batch processing. That scope expansion increases attack surface and enables unauthorized access to external accounts if the skill or a downstream component invokes these helpers unexpectedly; the risk is amplified because the same file also includes embedded fallback credentials.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: Exposing an OpenAI API key accessor in a band-ratio analysis skill is unjustified by the stated functionality and creates an unnecessary pathway to retrieve a high-value secret. Even without direct exfiltration in this file, unnecessary secret access materially increases the blast radius of any future misuse or compromise.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Managing credentials for FIRMS, CMA, and EOG is outside the stated role of local band-ratio computation and indicates unnecessary privilege aggregation. Consolidating unrelated secrets in one module makes accidental disclosure or abusive reuse more likely across otherwise unrelated workflows.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The batch downloader accepts a caller-controlled filename and joins it directly with output_dir using os.path.join without normalization or containment checks. An attacker who can influence filename could use absolute paths or traversal sequences such as '../' to write downloaded content outside the intended directory, enabling arbitrary file overwrite in locations writable by the process.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is described as performing local spectral-index/band-ratio analysis, but this code adds place-name resolution that can trigger outbound geocoding requests and process user-supplied location strings. That is a material capability mismatch: users invoking a raster-analysis skill would not reasonably expect external AOI resolution or network disclosure of queried locations, which expands both privacy and attack surface.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code performs HTTP requests to Open-Meteo and Nominatim using user-provided place names, even though the stated skill purpose is offline spectral-index computation. Unnecessary external requests can leak sensitive location queries, create dependency on third-party services, and enable hidden data exfiltration behavior under the guise of local geospatial analysis.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring frames the module as a harmless compatibility shim, but the implementation preserves functional fallback code that still executes legacy network geocoding. That framing can mislead reviewers and operators into underestimating real behavior, causing unexpected outbound access to remain deployed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-supplied place queries are sent to third-party geocoding services without any in-file disclosure or consent mechanism. That can leak sensitive research targets, user interests, or operational locations to external providers, which is especially relevant in geospatial workflows where place names may be confidential.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Resolved queries are persisted under the user's home directory by default, creating a local history of searched places without explicit notice. This can expose sensitive locations to other local users, backup systems, or forensic review, and it violates user expectations when location data is retained silently.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete Earthdata username and password. Embedded secrets in source code are highly dangerous because anyone with code access can reuse them, and they may be unintentionally propagated through repositories, package mirrors, backups, logs, or generated reports.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: Forcing the Accept-Language header to a Chinese locale without user choice is a privacy and transparency issue, and it can influence third-party service behavior in ways users did not request. While not a code-execution flaw, it is an unjustified hard-coded preference in a skill whose declared purpose does not require locale-specific geocoding behavior.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 79% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 77% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 77% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 76% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 75% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 78% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 90% confidence
• Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15