Geoskill: Download DEM

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:07 AM UTC
• Version: 6.0.1

Overview

The DEM downloader is mostly purpose-aligned, but it ships under-disclosed credential handling including real-looking embedded Earthdata credentials and local secret-file/.netrc reads.

Review this skill before installing. Its DEM download behavior is generally understandable, but do not rely on the documented credential boundary as written: remove or rotate the embedded Earthdata credentials, avoid shared fallback credentials, and require explicit user-provided tokens only. Also pin dependencies to reviewed versions and clarify or remove the bundled geocoding/cache helpers if they are not part of the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The documented skill purpose is narrowly about DEM download and processing, but the analyzed behavior reportedly includes broader credential handling, additional external services, place geocoding, and even hardcoded fallback credentials. That mismatch is dangerous because users may grant trust and permissions based on the published scope while the implementation accesses more services and secrets than expected, increasing the risk of data exfiltration, credential misuse, and unauthorized network activity.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module-level documentation claims passwords are not hardcoded in skill source, yet _DEFAULTS contains a real-looking Earthdata username and password. Hardcoded fallback credentials embedded in shipped code can be extracted by anyone with repository or package access, enabling unauthorized account use and undermining secret-rotation practices.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code supports retrieving Earthdata username/password through an auxiliary credential helper and exchanges them for a bearer token, despite the skill advertising a narrow environment-variable allowlist. In an agent setting, expanding accepted credential sources beyond the documented model increases the chance the skill becomes a broader secret-access primitive and may cause users or orchestrators to supply more sensitive credentials than necessary.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The comment states that only a hard-coded allowlist of environment variables is honored to prevent generic environment-secret access, but later implementation also accepts Earthdata credentials through other mechanisms. In security-sensitive agent ecosystems, this mismatch is dangerous because reviewers and policy engines may rely on the stated boundary while the runtime behavior exceeds it.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises external downloads and Chinese administrative-area resolution via a third-party geocoding service, but does not clearly warn users that their AOI, place names, and related query data will be transmitted to external providers. This creates a privacy and operational-security risk because users may unknowingly disclose sensitive locations or targets when using the tool.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim) automatically, which can expose sensitive location queries to third parties. In a geospatial download skill, AOI/place inputs may reveal private operational interests, so undisclosed outbound transmission is a real privacy/security issue even if it is functionally necessary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The resolver persists AOI results under the user's home directory without disclosure or consent, creating a local history of queried locations. This can leak sensitive geographic interests to other local users, forensic tooling, backups, or later processes, especially on shared or managed systems.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The _DEFAULTS map contains plaintext fallback credentials directly in code, including a username and password. Even if intended as a convenience fallback, embedding real secrets in source makes them recoverable from the repo, package artifacts, and logs/debug traces, and encourages silent use of shared credentials.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

from _geoskill_core.credentials import get_earthdata_token
        token = get_earthdata_token()
    except ImportError:
        token = os.environ.get(ALLOWED_CREDENTIAL_ENV_VARS["earthdata"])
    if not token:
        # Also accept EARTHDATA_USERNAME/PASSWORD by minting a short-lived
        # bearer token via the URS OAuth flow. Keep the env var as fallback

• Confidence: 88% confidence
• Finding: os.environ.get(ALLOWED_CREDENTIAL

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dem_download
fiona>=1.8.0
numpy>=1.21.0
planetary-computer>=0.5.0

• Confidence: 95% confidence
• Finding: dem_download

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dem_download
fiona>=1.8.0
numpy>=1.21.0
planetary-computer>=0.5.0
pystac-client>=0.6.0

• Confidence: 98% confidence
• Finding: fiona>=1.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dem_download
fiona>=1.8.0
numpy>=1.21.0
planetary-computer>=0.5.0
pystac-client>=0.6.0
rasterio>=1.3.0

• Confidence: 93% confidence
• Finding: numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dem_download
fiona>=1.8.0
numpy>=1.21.0
planetary-computer>=0.5.0
pystac-client>=0.6.0
rasterio>=1.3.0

• Confidence: 93% confidence
• Finding: planetary-computer>=0.5.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona>=1.8.0
numpy>=1.21.0
planetary-computer>=0.5.0
pystac-client>=0.6.0
rasterio>=1.3.0

• Confidence: 93% confidence
• Finding: pystac-client>=0.6.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
planetary-computer>=0.5.0
pystac-client>=0.6.0
rasterio>=1.3.0

• Confidence: 93% confidence
• Finding: rasterio>=1.3.0

Known Vulnerable Dependency: fiona==1.8.0 — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: fiona==1.8.0

Known Vulnerable Dependency: numpy==1.21.0 — 1 advisory(ies): CVE-2021-34141 (Incorrect Comparison in NumPy)

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: numpy==1.21.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_download_dem.py:24