geoskill-education-resource-allocation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:00 PM UTC
• Version: 1.0.0

Overview

The main school-planning tool is mostly local and purpose-aligned, but the package also includes under-disclosed credential, network, download, and persistent-cache code that does not fit the stated offline-only purpose.

Review this package carefully before installing. The documented school allocation command appears local, but the bundled reusable core contains exposed fallback credentials, can read local secret stores, can call external geocoding services, and can retain place-query cache files in the user's home directory. Install only if you are comfortable with those extra capabilities, or remove the unused credential, downloader, and AOI/geocoding modules first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation declares an offline, local-only education-planning tool, yet detected capabilities include shell, filesystem, environment access, and network without any declared permissions. That mismatch reduces transparency and can mislead users or hosting platforms about what the skill may access, enabling unnecessary exposure of local data, secrets, or external connectivity if the underlying code uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: a school-allocation skill should not need geocoding services, broad HTTP download logic, remote-service credential handling for unrelated providers, or embedded fallback credentials. Such unrelated capabilities materially increase attack surface and suggest hidden functionality, including possible credential exposure, unauthorized outbound data transfer, or supply-chain style abuse under the guise of an offline analytics tool.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The vendored metadata declares the embedded component as `landsat-download`, which does not match the stated skill purpose of education resource allocation. This kind of mismatch undermines supply-chain transparency and can hide inclusion of unrelated code, making review, provenance validation, and least-privilege assessment harder. In this context, a geospatial skill may legitimately reuse shared geospatial components, but the explicit skill-name mismatch is still suspicious because it suggests the vendored package may have been copied from or intended for a different capability.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The module persists geocoding queries and results under the user's home directory by default, which creates undeclared local data retention. Even though this is not remote compromise, it can expose sensitive location interests or operational context to other local users, backups, or forensic collection on shared systems.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module contains hardcoded fallback credentials for an external Earthdata account, which is a direct secret exposure and an unsafe credential-management pattern. In the context of a school-layout/equity skill, bundling broad external-service credential access is especially suspicious because it exceeds the stated purpose and could enable unauthorized use of third-party accounts or hidden data access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module retrieves credentials for unrelated services such as FIRMS, CMA, and EOG that do not obviously align with school layout optimization. Even if intended for geospatial enrichment, centralizing broad credential collection in a generic helper increases the chance of unauthorized access, misuse, or stealthy expansion of the skill's capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module retrieves credentials for unrelated services such as FIRMS, CMA, and EOG that do not obviously align with school layout optimization. Even if intended for geospatial enrichment, centralizing broad credential collection in a generic helper increases the chance of unauthorized access, misuse, or stealthy expansion of the skill's capabilities.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The docstring explicitly claims passwords are not hardcoded, yet `_DEFAULTS` includes a hardcoded username and password. This contradiction can mislead reviewers and users into trusting unsafe code, increasing the chance that embedded secrets remain unnoticed and deployed to production.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The implementation can partially allocate one zone's demand across multiple schools but stores only a single school index for that zone, while the docstring describes a single nearest-school assignment. This mismatch can corrupt downstream interpretation of allocation outputs, causing planners to believe demand is fully assigned to one facility when it was actually split, which can lead to incorrect coverage, load, and equity decisions.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The coverage calculation counts the full demand of any zone with a non-negative assignment, even when only part of that zone's demand was actually served. This can systematically overstate service coverage and hide unmet demand, producing misleading reports that may drive poor resource-allocation decisions in an education planning context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-provided place queries are transmitted to third-party geocoding services without any disclosure or consent mechanism in this file. Place names can reveal sensitive operational, personal, or institutional interests, so silent transmission to external providers creates a real privacy risk even if the requests are not otherwise malicious.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code writes geocoding results to a persistent cache in the user's home directory without any user-facing notice. This can leave a durable record of queried places and derived AOI data, creating unnecessary privacy exposure on multi-user systems or managed endpoints.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code includes hardcoded fallback credentials without adequate warning, and the comments even suggest they should not appear in source while they are present. This is dangerous because users and integrators may unknowingly ship working shared credentials, leading to account compromise, abuse, and loss of attribution.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of "zh-CN,zh;q=0.9" without user choice or caller control. This can leak a language/region preference to the third-party geocoding service and may bias returned place names or results, which is a privacy and correctness issue, though not typically a severe security flaw in this education resource allocation context.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 73% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 73% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 73% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 72% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 77% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 77% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 71% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 74% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15