Security audit
Security checks across malware telemetry and agentic risk
The main D-InSAR tool appears locally focused, but the package includes under-disclosed credential and network helper code unrelated to the stated offline analysis purpose.
Review this package before installing in any environment with credentials or sensitive location data. The D-InSAR entrypoint itself looks like local raster processing, but the bundled unused core includes credential discovery, hardcoded Earthdata credentials, network geocoding/download helpers, and a provenance mismatch. Prefer a cleaned package that removes unused helpers, removes hardcoded credentials, pins dependencies, and documents any network or credential behavior.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy
numpy rasterio scipy
numpy rasterio scipy
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution