geoskill-buffer-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:19 PM UTC
• Version: 1.0.1

Overview

The main buffer-analysis tool appears locally scoped, but the package also ships undisclosed network, credential, and persistence helpers that do not fit the advertised offline purpose.

Review before installing. The advertised CLI can be used as an offline buffer-analysis script, but the package also contains unrelated network and credential-management code, including hardcoded fallback credentials and readers for local secret files. Install only in an isolated environment, avoid granting access to home-directory secrets, and ask the publisher to remove or clearly document the extra modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions while the documented and inferred capabilities include file access, shell execution, environment access, and possible network use. Even if some of these capabilities are only exercised by the implementation rather than the markdown, an undeclared capability set prevents informed consent and can hide sensitive operations such as local file reads or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to perform local vector buffer analysis, but the detected behavior includes network geocoding/downloads, credential handling, reads from user secret stores, and even embedded default Earthdata credentials. Hidden credential access and undocumented network activity materially increase risk because users may provide geospatial inputs expecting purely local processing while the skill accesses secrets or external services.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata declares the skill as 'landsat-download' while the surrounding package is for buffer-analysis, indicating a supply-chain integrity mismatch. This can cause reviewers or automation to trust the wrong provenance, verify incorrect hashes, or accidentally ship reused code under a misleading identity, which increases the risk of hidden functionality or incomplete review.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module expands the skill’s behavior beyond the stated vector buffer/overlay/area-analysis scope by performing place-name geocoding and persistent local caching. That creates unnecessary data exposure and side effects: user-supplied locations may be transmitted to third-party services and stored on disk even when the skill description does not disclose those behaviors.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code sends user-provided place queries to external geocoding providers (Open-Meteo and optionally Nominatim), which is outbound data exfiltration to third parties relative to a skill described only as local geospatial analysis. In this context, place names may reveal sensitive operational, residential, or commercial locations, and the network access is not tightly justified by the declared functionality.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring claims these checks are mandatory and enforced before outputs are written, but the implementation only aggregates and returns issue lists. If callers assume enforcement occurs here and fail to reject bad results, invalid CRS, unit, nodata, or area-processing conditions may pass through silently, causing incorrect geospatial outputs and downstream decision errors.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module introduces broad credential-management and third-party authentication capabilities that are not justified by the stated skill purpose of vector buffer/overlay/area analysis. In a skill context, adding access paths for Earthdata, FIRMS, OpenAI, CMA, and EOG materially increases the attack surface and creates unnecessary opportunities to harvest or misuse user credentials.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads sensitive data from environment variables, ~/.geoskill/secrets.json, and ~/.netrc for several external services, despite the skill metadata not indicating any need for multi-service credential access. In an agent skill, this is dangerous because it normalizes secret harvesting from common local stores and can silently pull credentials the user did not intend to expose to this functionality.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The exported resolve_place API introduces external place-name resolution behavior that is not apparent from the stated skill description focused on buffer/overlay/area analysis. Hidden geocoding broadens the skill's capability surface, can transmit user-supplied locations to third-party services, and may violate operator expectations about data flow and network use.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The legacy fallback performs live HTTP requests to Open-Meteo and Nominatim, so even when the core module is unavailable the skill still sends location queries to external providers. This creates undeclared exfiltration and dependency behavior, and the fallback path may be overlooked during review because it is presented as compatibility code rather than a primary feature.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Place queries are transmitted to external services without any user-facing warning in this module, so users may unknowingly disclose sensitive locations. The danger is amplified because the skill context suggests purely spatial analysis, not remote geocoding, making the privacy-impacting behavior unexpected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module persists resolved query data in a cache under the user’s home directory without user-facing disclosure or opt-in. That can leave sensitive location history on disk, where it may be later accessed by other local users, processes, backups, or forensic collection.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Hard-coding Chinese language/locale preferences for geocoding without user choice can leak user locale assumptions and influence remote service behavior in ways users did not request. This is primarily a privacy and transparency issue rather than a direct code-execution risk, but it still represents non-consensual metadata sharing.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials that look like a real Earthdata username and password. Hardcoded secrets in source control can be reused by anyone with repository access, may already be compromised, and can also cause accidental unauthorized use of a shared account if environment configuration is absent.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: These helper functions silently resolve credentials from environment variables and local secret stores without any runtime disclosure or consent boundary. In a skill ecosystem, that makes credential access less transparent and increases the risk that users unknowingly grant the skill access to secrets unrelated to the immediate task.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing Accept-Language to zh-CN/zh without user choice can leak locale assumptions and shape third-party responses in a way the user did not request. While not directly leading to code execution, it is a privacy and policy issue because it embeds a regional preference into outbound requests and can affect correctness for non-Chinese users.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 96% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 96% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15