geoskill-climate-zone-classification

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

The advertised climate tool is mostly local, but the package also includes undisclosed location lookup, downloader, and credential code, including hardcoded external-service credentials.

Install only after reviewing or removing the unused geocoding, downloader, and credential modules. Treat the hardcoded Earthdata credential as exposed and do not run this package in an environment where undisclosed network access or home-directory credential reads are unacceptable. The main CLI appears to do local climate classification, but the package contents are broader than the user-facing description.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions, yet its documented/runtime capabilities include file I/O, shell execution, environment access, and network use. For a skill presented as an offline local climate-classification tool, this missing disclosure undermines trust boundaries and can lead users or host systems to permit behavior they did not knowingly authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to operate fully offline on local climate rasters, but analysis indicates geocoding, outbound network access, downloading, unrelated registries, credential handling, and embedded default Earthdata credentials. Hidden network behavior and bundled secrets materially expand the attack surface, risk data exfiltration, and can expose third-party accounts or enable unauthorized remote access.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata declares a different skill, 'landsat-download', inside a climate-zone classification package. This supply-chain mismatch is a real integrity issue because it suggests code reuse or bundling of functionality outside the stated purpose, making review and trust assumptions unreliable. In this skill context, unexpected downloader-related components are more dangerous because the advertised functionality is offline raster classification, not acquisition of external data.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The metadata lists safe_download.py and credentials.py in a skill whose description only requires local climate classification and statistics generation. Unnecessary downloader and credential-handling capabilities expand the attack surface by enabling outbound access, secret handling, or future misuse beyond the user-visible purpose. The mismatch makes this more concerning because users and reviewers would not expect network or credential code in this skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which is behavior beyond the climate-classification functionality described in the skill metadata. This creates a real data-exposure and dependency surface: sensitive locations may be disclosed to third parties, and network egress may violate user expectations or sandbox policy.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code persists AOI resolution results under the user's home directory in ~/.geoskill_core_cache, which is undeclared side-effectful behavior for a climate classification skill. Persistent local storage can leak sensitive place queries across runs, expose user activity to other local users/processes, and break least-surprise expectations for an analysis tool.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring states passwords are not cached, but load_user_secrets copies secrets from the user secrets file into the process-wide _DEFAULTS dictionary and retains them for the lifetime of the process. This creates a mismatch between documented behavior and actual secret handling, increasing the chance that long-lived processes, debugging, memory inspection, or unintended reuse expose credentials longer than operators expect.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The module provides generic outbound HTTP(S) retrieval for arbitrary URLs and batch downloads without any allowlist, domain restriction, or scheme validation. In a skill whose stated purpose is climate-zone classification, this materially expands capability and could be abused by downstream code to fetch attacker-controlled content, exfiltrate metadata via network access, or pull untrusted files into local processing pipelines.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file exposes place-name geocoding and AOI resolution behavior that expands the skill beyond pure climate-zone classification into network-backed location lookup. That creates an unexpected data egress and capability surface: user-supplied place names may be sent to third-party services, which is materially different from processing already-provided climate rasters.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code issues outbound HTTP requests to Open-Meteo and Nominatim using user-provided place queries, which introduces external data transmission and dependency on third-party services unrelated to the stated raster-classification purpose. In a skill advertised for climate classification, this hidden network behavior increases privacy, compliance, and supply-chain risk, especially if the environment assumes local-only geospatial processing.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The docstring frames the module as a simple compatibility shim delegating to a unified core, but the fallback path preserves a separate legacy implementation with its own network geocoding behavior. This mismatch can mislead reviewers and operators into underestimating the module's effective capabilities and data flows, weakening security review and deployment controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Place-derived AOI manifests are written to persistent cache files without any disclosure mechanism in this code path. Even if the stored filename is hashed, the manifest content still contains the original query and resolved coordinates, so sensitive location information can remain on disk and be recovered later.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The helper transmits user-supplied place queries to an external geocoding API without any disclosure in this code. User-entered locations can be sensitive operational or personal data, so silent transmission to third parties is a genuine privacy and policy concern even if done for legitimate functionality.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The fallback to Nominatim sends the same user location query to a separate third-party service, expanding the disclosure surface beyond the primary API. This increases privacy risk, complicates compliance, and may surprise users because their input can be shared with multiple providers depending on resolution flow.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete Earthdata username and password, inside source code. Hardcoded credentials are highly dangerous because anyone with repository or package access can recover and abuse them, and they are likely to be reused, leaked into forks, backups, logs, or derived artifacts.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module transmits raw user-provided place names to external geocoding providers without any warning, consent, or in-file disclosure. Even when the input seems low sensitivity, location queries can reveal personal, organizational, or mission-sensitive interests, making silent third-party sharing a privacy issue.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: Forcing the Nominatim Accept-Language header to zh-CN/zh without user choice is an unnecessary preference override that can influence provider behavior and reveal locale assumptions about the user or deployment. While not severe on its own, it is a privacy and transparency issue and can produce biased or unexpected results for non-Chinese users.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 90% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15