geoskill-climate-trend-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

The climate-analysis tool itself is mostly local, but the package also ships undisclosed network, cache, and credential helpers that do not fit the stated offline purpose.

Review before installing. The advertised CLI can be used locally with --bbox or --input, but the package should remove or clearly disclose the unused network, cache, and credential modules, delete the hardcoded credential fallback, correct vendored provenance metadata, and pin dependencies before broad distribution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares an offline local-analysis purpose, but static analysis detected broader capabilities including environment access, file read/write, shell execution, and network use without any explicit permissions declaration. This expands the trust boundary and can enable unintended data access, command execution, or outbound communication if those capabilities are invoked, especially because users would reasonably expect a purely local geospatial workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as an offline climate trend tool, yet the detected behavior includes geocoding, HTTP download logic, and helpers for multiple remote services and credentials unrelated to the stated function. Hidden or unrelated network/service functionality is dangerous because it can mislead users into exposing secrets, initiating unexpected outbound requests, or processing data outside the documented workflow.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The vendored metadata claims this package is for a different skill ('landsat-download') than the declared climate trend analysis function, which indicates a supply-chain integrity and provenance mismatch. Even though this file is metadata, such inconsistencies can cause reviewers or tooling to trust the wrong dependency set, hide accidental code reuse, or mask insertion of unrelated vendored components.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This module adds materially broader capabilities than the stated climate trend-analysis skill: external place-name geocoding and persistent cache-file writes to the user's home directory. Even if intended as convenience functionality, these behaviors expand the data exposure and filesystem side effects of the skill beyond what a user would reasonably expect from offline raster/time-series trend computation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and Nominatim), creating undisclosed outbound data flow. In the context of a climate trend-analysis skill, this is an unnecessary capability unless clearly disclosed and justified, because location queries may be sensitive and can leak user intent or areas of interest to external operators.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: Defaulting to a persistent cache directory under the user's home folder introduces local data retention unrelated to core trend analysis. Cached place-resolution results can reveal prior AOI queries and remain on disk without clear user awareness, which is a privacy and side-effect concern even if the stored data is not highly sensitive by itself.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The docstring claims ambiguous results are returned as candidates without silently picking the first, but the implementation later selects the first Nominatim result when available. This mismatch can cause silent AOI misresolution, leading analyses to run on the wrong region and potentially produce misleading outputs without user notice.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module centralizes access to a wide set of unrelated third-party credentials far beyond the declared scope of climate trend analysis. In a skill ecosystem, that broad credential surface increases the chance that another component can reuse this helper to access services the user did not expect, violating least privilege and enabling unnecessary secret exposure.

Context-Inappropriate Capability

High

• Confidence: 80% confidence
• Finding: FIRMS wildfire service credential support appears unrelated to Mann-Kendall/Sen slope climate trend processing. Unnecessary credential support broadens the secret inventory available to the skill and increases the risk of misuse or unintended cross-service access.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: FIRMS wildfire service credential support appears unrelated to Mann-Kendall/Sen slope climate trend processing. Unnecessary credential support broadens the secret inventory available to the skill and increases the risk of misuse or unintended cross-service access.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: EOG credential retrieval is outside the stated trend-analysis scope and unnecessarily exposes another secret source. In a reusable core module, this can let unrelated code paths gain access to credentials without a clear user expectation or documented need.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The code sends user-supplied place strings to third-party geocoding services (Open-Meteo and Nominatim), which can disclose potentially sensitive user intent, locations, or project context to external providers. In a skill described primarily as climate trend analysis, this external network behavior expands the trust boundary and may occur without explicit user awareness or consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Location queries are transmitted to external services without any user-facing disclosure in this file, creating a transparency and privacy problem. Users of a climate-analysis skill may reasonably assume local processing, so undisclosed geocoding requests can expose sensitive locations or project interests to third parties.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The module writes resolved place data to persistent cache files without a user-facing disclosure, creating undisclosed local retention. While lower severity than network exfiltration, this can still leak user AOIs to other local users, backups, or forensic inspection on shared or managed systems.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: Forcing the Accept-Language header to Chinese without user opt-in changes third-party request metadata and may influence returned place names unexpectedly. This is primarily a transparency and user-control issue rather than a direct exploit, but it is still an unnecessary override in a general analysis skill and may reveal assumptions about the user environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback Earthdata username and password in source code. Hardcoded credentials are highly sensitive because they can be harvested from the repository, reused by anyone with code access, accidentally propagated into downstream builds, and normalize insecure secret management.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice can alter returned results and leak assumptions about the user or deployment locale to the third-party service. While not severe on its own, it is an unnecessary privacy and behavior-affecting override in outbound requests.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15