geoskill-drought-severity-assessment

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:00 PM UTC
• Version: 1.0.0

Overview

The main drought tool is mostly local, but the package includes under-disclosed credential and network helper code, including hardcoded Earthdata credentials, that does not fit the published purpose.

Review this skill before installing. The documented drought command appears local, but the package should remove or clearly document the unrelated credential broker, hardcoded Earthdata password, geocoding/download helpers, home-directory caches, and unpinned dependencies. Do not install it in an environment containing valuable .netrc, geospatial service credentials, or OpenAI/API keys unless those extra modules are removed or isolated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises an offline geospatial drought workflow, but the detected capabilities include shell, file read/write, environment access, and network without any declared permissions. This creates an unsafe trust boundary because users cannot accurately assess what resources the skill may access, and hidden capabilities can enable data exfiltration, arbitrary command execution, or unintended filesystem modification if invoked by the underlying implementation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to perform drought grading, but the analysis indicates unrelated geocoding, remote downloading, multiple credential-management paths, and even embedded fallback Earthdata credentials. Hidden network access and bundled credential logic are especially dangerous because they expand the attack surface well beyond the documented purpose and can lead to unauthorized external communication or credential misuse.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata shows this skill bundles components from a different skill named "landsat-download," which is inconsistent with the declared drought-severity purpose. This kind of dependency mismatch is a supply-chain integrity issue: unexpected bundled code can introduce hidden capabilities, broaden attack surface, and defeat reviewer expectations about what the skill actually contains.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module contains a broad credential broker unrelated to the stated drought-severity purpose and includes support for multiple external services plus hardcoded fallback credentials. In a narrowly scoped geospatial skill, centralized access to unrelated secrets expands the attack surface and enables credential harvesting or later misuse if any downstream code imports these helpers.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Exposing an OpenAI API key accessor in a drought grading skill is unjustified by the declared functionality and creates an unnecessary path to sensitive credentials. Even without immediate exfiltration in this file, unnecessary secret access is dangerous because other code in the skill can later call this helper and use or leak the key.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Managing FIRMS and EOG credentials is outside the declared SPI+VHI drought assessment scope and unnecessarily broadens secret access. This violates least privilege and makes the skill more dangerous because a compromise of this code path can expose credentials for unrelated services.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The docstring claims passwords are not cached, but `load_user_secrets()` persists loaded secrets into the module-level `_DEFAULTS` dictionary for the life of the process. This increases exposure in long-lived runtimes, makes secret handling misleading to reviewers, and can lead developers to underestimate memory-resident secret risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: User-supplied place names are sent to third-party geocoding services without any disclosure or explicit consent in this component. In a geospatial drought-assessment skill, queried locations may reveal sensitive interests or operational areas, so silent exfiltration of those queries to external services creates a real privacy and data-governance risk.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Resolved AOI data is persisted under the user’s home directory by default without user-facing notice or consent. Even though the cache only stores geocoding results, those entries can reveal a history of places the user analyzed, which may be sensitive in operational or commercial drought-monitoring contexts.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The module hardcodes fallback credentials, including a cleartext Earthdata username and password, directly in source. Hardcoded secrets are a serious vulnerability because anyone with repository or package access can recover them, reuse them, and potentially pivot into external services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code sends raw user-provided place queries to third-party geocoding services without any user-facing disclosure, consent gate, or privacy notice. Even if the data seems low sensitivity, place names can reveal personal, operational, or sensitive locations, and transmitting them externally creates avoidable privacy and compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for Chinese without user choice, which can leak locale assumptions and alter returned content in ways the user did not request. This is primarily a privacy and transparency issue rather than a direct compromise, but it is unnecessary behavior that reduces user control.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 86% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15