geoskill-climate-downscaling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

The main climate downscaling tool appears local and coherent, but the package also includes under-disclosed credential, network geocoding, download, and home-directory cache helpers that do not fit the documented offline workflow.

Review this package before installing in sensitive environments. The main downscaling script appears to operate locally on bbox/synthetic data or local GeoTIFF input, but the distributed artifact includes unrelated credential and network-capable helper modules, including hardcoded fallback Earthdata credentials and code that can read user credential files if invoked. Prefer a cleaned package that removes unused vendored helpers, documents any network/cache behavior, and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill documentation declares an offline/local climate downscaling tool, yet the analyzer detected capabilities for environment access, file I/O, shell, and network without any explicit permission declaration or scoping. Even if some of these capabilities are legitimate for raster processing, leaving them undeclared reduces transparency and can allow unexpected access to local files, secrets, or external endpoints if the underlying implementation uses them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to perform local statistical downscaling, but the detected behaviors include geocoding, HTTP downloading, credential management, reading environment variables/.netrc/secrets, and even hardcoded default Earthdata credentials. That combination materially expands the attack surface and creates risk of secret exposure, unauthorized network access, and user deception because operators would not expect these capabilities from the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the embedded core came from the 'landsat-download' skill, while the surrounding skill is for climate downscaling. This provenance mismatch can break trust in the vendored dependency, causing reviewers and tooling to validate the wrong component and potentially masking supply-chain tampering or accidental inclusion of unrelated code.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module sends user-provided place names to external geocoding services, creating a privacy and data-governance risk that is not intrinsic to statistical downscaling. In a skill advertised mainly for climate downscaling, undisclosed network transmission of user queries expands the trust boundary and could leak sensitive locations or research targets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Geocoding requests transmit user-entered place queries to third-party services without any visible warning or consent mechanism in this file. Even if technically necessary for fallback resolution, undisclosed sharing of potentially sensitive location strings is a real privacy weakness, especially in a research or enterprise environment.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Resolved place data is persisted under the user's home directory without visible disclosure or retention controls. Cached AOI manifests can reveal places of interest, study areas, or operational locations to other local users/processes depending on host configuration, which makes this a privacy issue rather than a remote code risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext username and password. Embedded credentials are dangerous because anyone with source access can recover and reuse them, and the helpers will silently use them when environment variables or local secrets are absent, potentially causing unauthorized access under a shared account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends raw user-provided place queries to third-party services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive location intent without any notice or consent mechanism in this file. Even if only place names are transmitted, user queries may encode home/work locations, project sites, or other sensitive operational context.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 92% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 89% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 92% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 94% confidence
• Finding: scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15