geoskill-dam-safety-monitoring

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:51 AM UTC
• Version: 1.0.0

Overview

The main dam-monitoring script is mostly local, but the package includes under-disclosed credential and network helper code, including a hardcoded Earthdata password.

Review carefully before installing. The main CLI appears to perform local dam-risk analysis from a bbox or local GeoTIFF, but the package should remove the committed Earthdata password, document or disable external geocoding and home-directory caches, and pin dependencies before it is suitable for routine use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises executable usage and, per the static finding, has capabilities including environment access, file I/O, networking, and shell execution without any declared permissions or user-facing disclosure. This creates a transparency and trust boundary problem: users may run a seemingly local geospatial skill without understanding it can access broader system and network resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: the skill is presented as a dam safety remote-sensing fusion tool, but the analyzed behavior includes default credential fallback, external geocoding access, a generic arbitrary-URL downloader, and unrelated utility components. Such hidden or overbroad behavior is dangerous because it expands the attack surface, can enable data exfiltration or unintended remote fetches, and misleads users about what the skill actually does.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation says passwords are not hardcoded, yet `_DEFAULTS` includes a concrete Earthdata username and password. Hardcoded credentials in source are a direct secret exposure risk and can enable unauthorized access by anyone with repository or package access.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The legacy resolver sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which creates an external data disclosure path not clearly constrained by the skill’s stated purpose. In a dam-safety context, queried locations may reveal sensitive sites, investigative targets, or operator interests, so unnecessary outbound requests increase privacy and operational-security risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: User-supplied place names are transmitted to third-party geocoding services, which can leak sensitive operational intent, locations, or infrastructure names outside the local environment. In a dam-safety monitoring skill, AOI queries may reveal critical facility locations or investigation targets, making silent outbound disclosure more sensitive than in a generic mapping tool.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The code persists resolved queries in a predictable cache directory under the user's home folder without user-facing disclosure or consent. Those cached place names and AOIs can expose sensitive analysis targets over time, especially on shared systems or when home directories are backed up, synchronized, or inspected by other local users/processes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The `_DEFAULTS` block contains fallback credentials, including a non-empty Earthdata password, without a strong runtime warning or installation-time disclosure. This creates silent credential reuse across deployments and increases the chance of accidental unauthorized access, credential leakage, and difficult-to-audit shared-account behavior.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Forcing the Accept-Language header to zh-CN/zh without user choice is not severe by itself, but it leaks an implementation preference and can influence third-party service behavior in ways the user did not request. In some environments this can expose regional assumptions or produce inconsistent results that affect downstream analysis and auditability.

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 93% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15