geoskill-carbon-stock-estimation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

The advertised carbon-estimation tool appears locally scoped at its main entrypoint, but the package contains under-disclosed network geocoding and credential-handling code, including plaintext fallback credentials.

Review this package before installing in environments with sensitive project locations or credentials. The documented carbon-estimation command is local, but the package includes extra helpers that can use network geocoding, write a home-directory cache, and read local credential stores; the embedded Earthdata credentials should be removed or rotated by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the skill actually includes geocoding, remote downloads, credential handling, and especially embedded fallback credentials while claiming to run fully offline for local carbon estimation, that is a serious description-behavior mismatch. Hidden network activity and bundled secrets can expose user data, trigger unauthorized external access, and indicate supply-chain style overreach far beyond the stated carbon-estimation purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file performs outbound geocoding requests to third-party services and persists AOI query results to a local cache, which exceeds the skill's stated outputs and creates undisclosed data egress and retention. Even if the data is only place names and bounding boxes, user-supplied locations can be sensitive, and sending them externally or storing them on disk can violate privacy or deployment expectations.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The docstring says ambiguity is handled by returning candidates without silently taking the first result, but resolve_place ranks candidates and automatically selects one. This mismatch can cause users to believe there is human-visible ambiguity handling when the code may actually resolve to the wrong location, potentially producing incorrect downstream geospatial analysis or unintended external requests for sensitive places.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User-provided place queries are transmitted to external geocoding providers without any visible warning in this file. In this skill context, AOI names may reveal sensitive project locations, land parcels, or operational areas, so silent third-party disclosure is a real privacy and compliance risk even if no code execution occurs.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Resolved AOI manifests are written to a persistent cache under the user's home directory without explicit disclosure in this file. While the cached content is limited, it can retain sensitive location history and create unexpected forensic artifacts on shared systems or regulated environments.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials for Earthdata, including a plaintext username and password, and automatically loads user secrets from a home-directory file. Hardcoded secrets are inherently sensitive because they can be reused by anyone with source access, and the automatic fallback behavior can silently cause a skill to access external accounts without explicit user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The Nominatim request hard-codes the Accept-Language header to zh-CN regardless of user preference or locale. This can bias results, produce incorrect place resolution for non-Chinese users, and create avoidable privacy/profile leakage about assumed language or region during third-party requests.

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 92% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 91% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 90% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 96% confidence
• Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15