geoskill-biodiversity-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:40 AM UTC
• Version: 1.0.0

Overview

The main biodiversity tool is local raster processing, but the package also ships under-disclosed network, credential, and cache helpers, including a hardcoded Earthdata password.

Review before installing. The documented mapping command appears local, but the package should remove or clearly document the unused network, downloader, cache, and credential helpers, remove and rotate the exposed Earthdata password, and pin dependencies. If you must test it, use an isolated environment and avoid invoking the helper modules directly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares a fully offline biodiversity-mapping workflow, yet static analysis detected capabilities for environment access, file read/write, network, and shell use without corresponding permission declarations. This is dangerous because operators may trust the documented privacy boundary while the implementation can access broader system resources, increasing the chance of unexpected data access, command execution, or outbound communication.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to locally compute biodiversity proxies, but the analyzed behavior includes geocoding, generic HTTP download logic, broad remote-service access, credential handling for multiple external services, and even hardcoded fallback credentials. Such hidden functionality materially expands the attack surface and can lead to secret exposure, unauthorized network access, data exfiltration, or repurposing the skill as a general downloader unrelated to its stated ecological task.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The legacy fallback silently makes external requests to Open-Meteo and optionally Nominatim, even when the primary implementation fails. This creates undisclosed data egress of user-supplied place queries to third-party services and can surprise operators who believed the skill only performed local biodiversity processing.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: User-provided place queries are sent to third-party geocoding services without any clear disclosure or consent mechanism in this code path. In a geospatial analysis skill, AOIs may reveal sensitive operational, ecological, or personal interests, so silent transmission to external services creates a real privacy and data-governance risk even though it is not remote code execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Resolved AOI manifests are persisted under the user’s home directory by default, with no consent flow, retention control, or permission hardening visible here. Cached location lookups can expose sensitive places of interest to other local users, backup systems, or forensic review, especially in research or conservation workflows where locations may be confidential.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials, including a concrete Earthdata username and password in source code. Embedded secrets are dangerous because anyone with repository access can recover and reuse them, and downstream code may silently authenticate with these credentials in unintended environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15