geoskill-crop-counting-yield

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:47 AM UTC
• Version: 1.0.0

Overview

The main tool appears to do local crop analysis, but the package also includes under-disclosed credential, geocoding, download, and persistent cache helpers that do not fit the advertised offline-only behavior.

Review this skill before installing. The crop-counting entrypoint itself looks local, but the package carries unrelated geospatial core code that can contact third-party geocoders, read local credential stores, cache location lookups in your home directory, and fall back to embedded Earthdata credentials. Install only if you are comfortable auditing or removing those helper modules and pinning dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation declares no permissions, yet the analyzed capability set includes environment access, file read/write, shell, and network use. This is dangerous because users and review systems may trust the skill as local/offline when it can actually access sensitive data, modify files, and communicate externally, creating an opportunity for data exposure or unexpected command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is narrow crop counting and yield estimation, but the implementation reportedly includes broad remote-service access, credential handling, geocoding, download helpers, and even embedded default Earthdata credentials. This mismatch is dangerous because it conceals materially different behavior from users and reviewers, and the credential/network features expand the attack surface well beyond the stated analytics task.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This crop-counting/yield skill exposes helper access to multiple unrelated secrets, including OpenAI, CMA, FIRMS, and EOG credentials, which exceeds the apparent minimum needed for the stated functionality. Broad credential access increases the blast radius if other code in the skill or its dependencies misuse these helpers, enabling unauthorized use of external services and secret harvesting from the user's environment.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly says passwords are not hardcoded, but `_DEFAULTS` contains a hardcoded Earthdata username and password. That contradiction is a strong indicator of unsafe secret handling and can mislead reviewers and users into trusting code that silently falls back to embedded credentials.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The module sends user-supplied place queries to external services (Open-Meteo and optionally Nominatim), which can disclose sensitive operational or user location data to third parties without clear necessity from the stated crop-counting purpose. In this skill context, hidden or weakly justified network egress is more concerning because users may expect local image analysis rather than remote geocoding of farm/site names.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module sends user-provided place queries to third-party geocoding services without any in-code disclosure or explicit consent mechanism. In a crop-counting/yield skill, AOI names can reveal sensitive farm or operational locations, so this creates a real privacy and data-handling risk even though it is not classic code execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Resolved queries are persisted under the user's home directory without disclosure or consent, creating a local privacy leak. Place queries for agricultural analysis may expose sensitive property names, farm locations, or operational interests to other local users, backups, or forensic collection.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: Hardcoded fallback credentials are present in executable code and are automatically used when environment or local secret sources are absent. Embedded credentials can be extracted by anyone with repository access and may lead to unauthorized service access, account abuse, and compromise of any data or quotas tied to that account.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Forcing the Accept-Language header to zh-CN/zh without user choice can leak an inferred regional or linguistic preference and may alter provider responses in ways the user did not request. While not a severe exploit primitive, it is a privacy and policy issue because it imposes locale-specific behavior during third-party requests.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-image

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-image

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-image

• Confidence: 96% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-image

• Confidence: 95% confidence
• Finding: scikit-image

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15