geoskill-bare-soil-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:39 AM UTC
• Version: 1.0.0

Overview

The documented bare-soil mapper is mostly local, but the package also includes undisclosed network, downloader, and credential-handling code, including plaintext fallback credentials.

Review this package before installing in an environment with valuable credentials. The core mapping command appears local, but the artifact bundles extra network and credential helpers; remove or isolate those helpers, rotate the exposed Earthdata credential if real, and pin dependencies before using it in a sensitive workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a serious description-behavior mismatch because the skill is presented as an offline bare-soil mapper, yet the finding indicates additional behaviors such as network geocoding, generic downloading, multi-service credential handling, and even hardcoded default credentials. Hidden networked functionality and embedded secrets materially expand the attack surface, can exfiltrate data, and violate user expectations and least-privilege assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The AOI helper sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which is behavior not disclosed by the skill description. This creates a real privacy and supply-chain exposure because location queries may be sensitive and are transmitted to third parties during normal operation.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module persistently writes AOI cache files under the user's home directory, which is a side effect not reflected in the manifest description. Persistent storage of user queries can leak sensitive location interests, survive beyond a single run, and surprise users or downstream systems that expect stateless processing.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This credential manager is scoped far beyond the stated bare-soil mapping purpose and includes support for unrelated services such as OpenAI, CMA, FIRMS, and EOG. Expanding credential access without clear functional need increases the attack surface and creates unnecessary pathways for a skill to read sensitive secrets from the host environment.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: The code exposes accessors for multiple third-party credentials that are not justified by the skill's described function. Even without exfiltration code in this file, a broadly shared helper that can retrieve unrelated secrets enables later misuse by other skill components or future changes.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The module claims passwords are not hardcoded, yet `_DEFAULTS` contains a plaintext `EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`. Hardcoded credentials are immediately recoverable from source control, packages, logs, or memory inspection, and they may grant unauthorized access wherever reused.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documentation states that passwords are not cached and are read on each call, but `load_user_secrets()` copies secrets into the in-memory `_DEFAULTS` dictionary and reuses them. This inconsistency can mislead reviewers and operators about secret lifetime in process memory, increasing the chance of unsafe deployment assumptions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-provided place queries are transmitted to external services without any in-code notice, confirmation, or clear disclosure path. In a geospatial workflow, queried locations can reveal sensitive projects, customer sites, or personal places, so silent exfiltration to third parties is a meaningful privacy issue.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code embeds plaintext fallback credentials with no warning to users that the software may authenticate using a shared built-in account. This can lead to silent unauthorized use, accidental credential reuse, and exposure of secrets to anyone who can read the codebase or installed package.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The code sends user-provided place names to third-party geocoding services without any notice or consent mechanism in this file. Even if place names are not highly sensitive in many cases, they can reveal user interests, project locations, or sensitive sites, creating an avoidable privacy leak.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15