geoskill-cloud-removal-gapfilling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:45 AM UTC
• Version: 1.0.0

Overview

The main cloud-removal script is mostly local, but the package also ships under-disclosed credential, geocoding, download, and cache helpers outside the advertised purpose.

Review before installing. The advertised cloud-removal entrypoint appears local, but the package contains extra helper modules with credential access, hardcoded Earthdata fallback credentials, remote geocoding, generic download code, and persistent home-directory caching that are not disclosed in the skill instructions. Install only in an environment where those bundled capabilities are acceptable, or remove/disable the unrelated helper modules and rotate the exposed Earthdata credentials before publishing or use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions while the detected capabilities include shell, file read/write, environment access, and network. Even though SKILL.md is mostly documentation, this mismatch is dangerous because users and orchestrators may trust the privacy/offline claims and run a skill that can access local data, secrets, and external services without clear disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is limited to cloud removal/gap filling, but the detected behavior includes geocoding, external network access, generic downloading, credential discovery from env/.netrc/secrets, and even a default NASA Earthdata credential fallback. This is a serious trust-boundary violation: a seemingly local geospatial processing skill may exfiltrate data, use hidden credentials, or perform unintended remote actions far beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This module exposes a broad credential broker for multiple external services that are not justified by the stated cloud-removal/temporal compositing purpose. Even without direct exfiltration code in this file, widening the credential surface increases the chance that other skill components can later access unrelated secrets, violating least privilege and creating unnecessary supply-chain risk.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Providing OpenAI API key access in a geospatial cloud-removal skill is unrelated to the declared functionality and creates an unjustified path to sensitive third-party credentials. If any downstream code uses this helper, the skill could silently consume or transmit the user's LLM credentials, making the context more dangerous because the advertised task does not prepare users for such access.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Support for FIRMS, CMA, and EOG credentials is broader than necessary for a skill described as multi-temporal cloud removal and gap filling. Unrelated secret access expands the attack surface and enables credential harvesting or misuse through future code paths, especially in an agent environment where users may not inspect every helper module.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The docstring states that Earthdata tokens can be sourced from the .netrc account field, but the implementation of get_earthdata_token only calls _resolve and never reads .netrc. This mismatch can cause operators to rely on a storage mechanism that is actually ignored, leading to authentication failures and potentially insecure workarounds such as embedding tokens elsewhere.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The public API exposes generic place-name resolution and delegates to a shared geocoding core, which is functionality outside the stated cloud-removal/gap-filling purpose. This kind of scope expansion increases attack surface and can enable unexpected data egress or hidden capabilities in a skill users would not expect to perform geocoding.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code performs outbound HTTP requests to third-party geocoding services, sending user-supplied place strings off-platform. In a skill described only as cloud-removal/gap-filling imagery processing, this is an unjustified network capability that creates privacy, compliance, and supply-chain risk if sensitive locations or internal project names are queried.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: User-supplied place queries are sent to third-party geocoding services without any visible consent or disclosure in the code path, which can leak sensitive location intent or operational context. In a geospatial processing skill, AOIs may reveal projects, assets, or subjects of interest, so silent transmission creates a real privacy and supply-chain exposure.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: Resolved AOI data is written persistently to a cache in the user's home directory without clear disclosure, creating an undeclared local record of places the user queried. That can expose sensitive location history to other local users, backups, or later processes, especially on shared systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code hardcodes a fallback Earthdata username and password directly in source. Hardcoded credentials are a direct secret exposure: anyone with repository or package access can recover and reuse them, and the danger is heightened because this is a credential helper intended to centralize secret access across skills.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 68% confidence
• Finding: ~/.netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15