geoskill-data-versioning

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:53 AM UTC
• Version: 1.0.0

Overview

The advertised tool is local vector-data versioning, but the package also bundles unrelated network, geocoding, download, and credential-handling code, including hardcoded fallback credentials.

Treat this as a Review item before installing. The main tool appears to perform local version snapshots, but the package should remove or clearly separate the unrelated geocoding, downloader, and credential modules, delete hardcoded credentials, disclose any network behavior, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions, yet the detected capabilities include file read/write, shell, environment access, and network. This creates a trust and transparency problem: users may run a seemingly local/offline versioning skill without realizing it can access broader system resources, increasing the chance of unintended data exposure or command execution in downstream code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is lightweight local vector-data versioning, but the detected behavior includes remote geocoding, HTTP download helpers, credential management for multiple external services, and even embedded fallback credentials. This mismatch is dangerous because it hides materially different capabilities from the user, and the presence of credential-handling plus hardcoded external-service access greatly increases the risk of secret leakage, unauthorized network access, and supply-chain style abuse.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata claims the core package belongs to a different skill ('landsat-download') than the declared purpose of this skill ('vector-data versioning'). This kind of provenance mismatch undermines supply-chain trust, makes it harder to verify that the bundled core is the expected one, and can conceal accidental or unauthorized code reuse across skills.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module introduces external geocoding and AOI resolution behavior that is outside the stated commit/diff/log vector data versioning scope. Scope expansion matters because it sends user-supplied place names to third-party services and increases data exposure and attack surface without a clear need for the advertised skill purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code sends user queries to Open-Meteo and Nominatim, adding third-party network capability unrelated to the described data-versioning role. In this skill context, undisclosed outbound requests can leak sensitive project names, sites, or operational locations and create unnecessary dependency on external services.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module defines a persistent cache path under the user's home directory for query-derived AOI data even though persistent location caching is not justified by the stated versioning purpose. This can leave sensitive geographic queries on disk, potentially readable by other local processes or later users of the same environment.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: This module materially expands the skill’s capability from local vector-data versioning into broad credential brokerage for multiple external services. In a skill whose stated purpose is commit/diff/log on vector data, bundling cross-service secret resolution increases attack surface and creates opportunities for credential misuse or unexpected outbound access beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Supporting OPENAI_API_KEY in a geospatial versioning credential manager is unjustified by the declared functionality and creates an unnecessary path to access a sensitive third-party API credential. Unneeded secret collection is dangerous because any later code in the skill can reuse or exfiltrate that key without the user expecting AI-service access from a versioning tool.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The documentation advertises support for numerous remote data providers unrelated to the narrow commit/diff/log scope. Even if not immediately exploited in this file, broad provider support normalizes over-privileged secret access and makes later misuse easier, especially in an agent context where users may not expect cross-service credential harvesting.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring claims passwords are not cached, but load_user_secrets() copies secret values into the module-global _DEFAULTS dictionary and retains them for the process lifetime. This discrepancy is security-relevant because long-lived in-memory secret retention increases exposure to memory disclosure, debugging leaks, and accidental reuse outside the original call context.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements a general-purpose network downloader with retries, resume, and arbitrary URL support, which is outside the declared scope of a vector-data versioning skill focused on commit/diff/log operations. This expands the skill's capability to fetch untrusted remote content and write it to disk, increasing attack surface for supply-chain abuse, unexpected data ingress, and misuse by downstream code that may trust downloaded artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The `_http_get` helper accepts arbitrary URLs and performs remote fetches via `requests` or `urllib` without host restrictions, scheme restrictions, or explicit SSRF safeguards. In a skill whose stated purpose is local vector-data versioning, this unjustified fetch primitive can be abused to access attacker-controlled resources or internal network endpoints if the URL is influenced by untrusted input.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements place-resolution and external geocoding logic even though the skill is described as vector-data versioning with commit/diff/log operations. That scope mismatch is security-relevant because it introduces unexpected data flows, expands the attack surface, and can cause user-supplied place names to be sent to third-party services without clear necessity or consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs outbound requests to Open-Meteo and Nominatim using user-provided place input, which is unjustified for the stated purpose of vector-data versioning. In this context, the main risk is unauthorized exfiltration of sensitive project, location, or operational data to third parties, plus increased supply-chain and availability risk from network dependencies that users would not expect from an offline-style versioning skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Place queries are transmitted to external geocoding providers without any user-facing disclosure in this file. In a data-versioning skill, users would not reasonably expect their place strings to leave the environment, so this creates a privacy and transparency issue that could expose sensitive locations or customer/project names.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The module writes resolved AOI data to a persistent cache in the user's home directory without disclosure. Although lower severity than network exfiltration, silent local persistence can still expose sensitive location history and violate user expectations for a versioning-focused tool.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback credentials, including a plaintext Earthdata username and password, directly in source. Hardcoded secrets are dangerous because they can be extracted by anyone with code access, reused unexpectedly in production, and may represent real credentials that enable unauthorized access or account abuse.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN, which overrides user or system locale without consent. While not a direct code-execution issue, it can leak localization assumptions, affect returned results, and create privacy/compliance concerns by signaling a user profile characteristic to an external service unnecessarily.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 85% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 99% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 97% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 99% confidence
• Finding: fiona

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15