geoskill-building-density-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:41 AM UTC
• Version: 1.0.0

Overview

The main density tool is local, but the package also includes under-disclosed network, credential, and cache code that should be reviewed before installation.

Install only after reviewing or removing the unrelated vendored core modules, especially credentials.py, safe_download.py, _place.py, and _geoskill_core/aoi.py. Avoid using this package on machines with sensitive ~/.netrc or ~/.geoskill/secrets.json entries unless the credential helpers are removed or clearly isolated, and rotate any real Earthdata credential represented by the hardcoded fallback.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation declares an offline/local geospatial processing tool, yet the detected capabilities include shell, file read/write, environment access, and network without any corresponding permission declaration. This creates an unsafe trust boundary because users may run the skill expecting only local raster math while the implementation can access the filesystem, environment variables, and remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: a skill presented as building-density estimation reportedly also performs remote geocoding, downloading, credential management for multiple services, and even contains hardcoded fallback Earthdata credentials. Hidden network/credential functionality materially changes the risk profile, enabling data exfiltration, unauthorized external access, or abuse of embedded credentials under the guise of a benign offline analytics tool.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The vendored metadata explicitly says the embedded core belongs to the 'landsat-download' skill, which does not align with this skill's stated purpose of building-density and FAR estimation. That mismatch is dangerous because it indicates code provenance confusion or accidental package substitution, which can introduce unrelated capabilities and undermine reviewers' ability to trust what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The listed vendored files include 'safe_download.py' and 'credentials.py', which imply network retrieval and credential-handling functionality not justified by a local building-density estimation workflow. Unnecessary download and secret-management code expands the attack surface, may enable unexpected external access, and creates risk of credential misuse or data exfiltration if invoked.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This helper adds outbound geocoding and persistent local caching capabilities that exceed the narrowly stated building-density/FAR estimation purpose. That matters because user-supplied place names may contain sensitive locations and are transmitted to third parties and written to disk, expanding the skill's data exposure and attack surface beyond what users may expect.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code sends place queries to Open-Meteo and Nominatim, introducing third-party data disclosure and dependency on external services not clearly justified by the skill's declared purpose. If users enter precise addresses, private sites, or sensitive operational locations, those values are exposed off-system without in-file warning or consent flow.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module centralizes access to multiple external-service credentials that are not justified by the stated purpose of a building-density mapping skill. Broad credential reach increases the blast radius of any downstream misuse, making it easier for other code in the skill to access unrelated accounts and data sources without clear user intent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code exposes helper functions for retrieving OpenAI and several remote-data service credentials even though the skill description only concerns local geospatial density/FAR estimation. Unnecessary secret retrieval is dangerous because it normalizes over-privileged access and enables covert exfiltration or unauthorized API use by any code path that imports this module.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements place-resolution and external geocoding logic even though the skill is described as estimating building density and FAR from building footprints and heights. That functionality expands the skill's capabilities beyond its declared purpose, creating unnecessary data flows and a larger attack surface through third-party requests and location handling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends user-supplied place names to external services (Open-Meteo and Nominatim), which can leak sensitive or proprietary locations and introduce dependency on remote infrastructure unrelated to the stated analytic purpose. In the context of a building-density skill, these outbound lookups are insufficiently justified and increase privacy, compliance, and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Place queries are sent to external geocoding services without any user-facing warning in this module, creating a privacy and transparency issue. Users may reasonably assume local processing for AOI resolution and may inadvertently disclose home, workplace, or sensitive infrastructure locations to third parties.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Resolved place data is cached under the user's home directory without clear disclosure, which can persist sensitive location queries beyond the current session. Local attackers, other users on shared systems, backup systems, or forensic collection could recover these cached locations.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: Forcing the Accept-Language header to zh-CN influences how a third-party service processes and logs requests without user opt-in. While not a severe exploit path, it is an unnecessary privacy and policy concern because it imposes locale preferences that may reveal assumptions about the user or alter returned results unexpectedly.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The module contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Embedded credentials are a severe secret-management failure: anyone with source access can reuse them, and any deployment inheriting these defaults may silently authenticate to a real external account without user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing the Nominatim request header to 'zh-CN,zh;q=0.9' overrides locale behavior without user choice or clear justification. This can disclose assumptions about user profile or deployment region, bias returned results, and produce inconsistent or misleading geocoding behavior in environments where locale sensitivity matters.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 91% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 87% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15