geoskill-desertification-monitoring

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:11 PM UTC
• Version: 1.0.0

Overview

The main desertification tool is mostly local, but the package also includes undisclosed network, caching, and credential-handling code that does not fit the stated offline purpose.

Review this package carefully before installing. The documented CLI appears intended for local raster analysis, but the bundle should remove or clearly disclose the geocoding, cache, downloader, and credential modules, eliminate hardcoded credentials, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its documented capabilities imply access to environment variables, filesystem I/O, shell execution, and possibly network behavior. Even if some of these are only used indirectly by example commands or supporting code, the absence of explicit permission declarations prevents reviewers and users from understanding the true attack surface and can enable unexpected data access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to be an offline desertification-grading tool, but the detected behavior includes unrelated network geocoding, generic downloading, broad credential handling, and even bundled fallback credentials. That combination materially increases risk because users may trust the skill with local geospatial data while hidden or undocumented components can exfiltrate data, misuse secrets, or perform actions far beyond the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored core metadata declares the skill as 'landsat-download' while the enclosing skill is desertification monitoring, creating a provenance and integrity mismatch. This can hide accidental or unauthorized reuse of a different component, confuse auditors and tooling, and weaken trust in the packaged dependency set even if the file hashes are present.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The AOI helper sends user-supplied place names to third-party geocoding services as part of normal operation, which expands the skill beyond purely local desertification analysis into external data disclosure. In a geospatial workflow, place queries can reveal sensitive locations of interest, and this transfer is not obvious from the stated analytics-focused skill description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code persists AOI query results under the user's home directory, creating undisclosed local retention of potentially sensitive geographic interests. Even though the cached data is limited, persistent storage can expose historical queries to other local users, backups, or later processes and is not aligned with the manifest's narrow analysis description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module centralizes access to multiple external-service credentials, including services not justified by the desertification-monitoring skill’s stated purpose. More critically, it embeds fallback credentials in source and exposes helpers that can read user secrets from environment variables, ~/.netrc, and a user secrets file, substantially expanding the skill’s access to sensitive accounts and increasing the blast radius if the skill or a dependent component is abused.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Adding OpenAI API credential handling to a geospatial desertification skill is unjustified by the declared functionality and broadens the set of secrets the skill can access. Even without immediate exfiltration code in this file, unnecessary secret access violates least privilege and creates an avenue for unrelated external-service use if another part of the skillchain calls this helper.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The code hardcodes fallback credentials directly in _DEFAULTS, including a concrete Earthdata username and password. Hardcoded credentials are highly dangerous because anyone with source access can recover them, reuse them against the external account, and inherit access without user consent; in this skill context, that access is unrelated to local raster grading logic and therefore especially suspicious.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-provided place strings are transmitted to Open-Meteo and optionally Nominatim without any warning in this file, which creates a privacy and transparency issue. In geospatial analysis, location queries may correspond to sensitive projects, field sites, or operational interests, so silent transmission to external services is risky.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The helper writes resolved place data to a persistent cache in the user's home directory without visible disclosure, creating silent retention of geographic query history. That can leak sensitive areas of interest through local compromise, shared accounts, backups, or forensic review.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded fallback credentials in code are a genuine secret-management failure regardless of whether there is a warning. The absence of any user-facing disclosure worsens the risk because users may unknowingly run code that authenticates to third-party services using embedded credentials, obscuring provenance and accountability.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN/zh, overriding user locale expectations without consent. This can disclose locale bias to the third-party service and may produce region/language-skewed results, which is a minor privacy and integrity issue in a geocoding workflow.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15