geoskill-environmental-impact-assessment

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:02 PM UTC
• Version: 1.0.0

Overview

The main tool appears to perform local environmental raster analysis, but the package also contains under-disclosed network, caching, and credential-handling code, including embedded Earthdata fallback credentials.

Review this package before installing. The EIA script itself appears local, but the package should remove embedded credentials, disclose or disable network geocoding and cache behavior, narrow credential access to what the skill actually needs, and pin dependencies. Use an isolated environment and avoid providing secrets to this skill until those issues are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill declares an offline/local environmental-impact workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any explicit permission model. Even if some of these are only used for setup or optional paths, undeclared privileged capabilities enlarge the attack surface and can surprise users who expect a purely local geospatial tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to run fully offline with no external data requests, but analysis indicates online geocoding, HTTP downloads, credential handling, and even built-in default NASA Earthdata credentials fallback. That combination can lead to silent network exfiltration, use of embedded secrets, credential misuse, and execution of behavior far outside user expectations for a local raster-analysis tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata claims the embedded core comes from the 'landsat-download' skill, while this package is presented as an environmental-impact-assessment skill. This mismatch undermines provenance and supply-chain trust: reviewers and automated tooling may validate the wrong component, and hidden code reuse or mispackaging can conceal unintended or unsafe functionality.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The AOI helper performs outbound geocoding requests and persists results to local cache files, which expands behavior beyond a narrowly described environmental-impact scoring skill. That creates privacy and supply-chain exposure because user-provided place names may be sent to third parties and stored on disk without clear consent or a manifest-level declaration.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code includes network geocoding via Open-Meteo and Nominatim even though the stated skill scope is environmental impact assessment outputting GeoTIFF results. Hidden network capability is risky because it can exfiltrate sensitive place queries and introduces dependency on external services not apparent from the manifest.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This module is a broad credential broker for multiple external services, including OpenAI, CMA, FIRMS, Earthdata, and EOG, which exceeds the narrow needs of an environmental-impact assessment skill. Centralizing access to unrelated secrets increases the blast radius: any downstream code importing this helper can reach credentials that are unnecessary for the task, enabling secret misuse or lateral access if the skill or a dependency is compromised.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The code contains hardcoded fallback Earthdata credentials in plaintext. Embedded credentials are directly recoverable from source control, package artifacts, or logs/debugging, and can be abused by anyone with code access to authenticate to the external service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Place queries are transmitted to third-party geocoding services without any clear user disclosure in this code path. If users provide sensitive locations, those queries may be logged by external providers, creating a confidentiality and compliance issue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module stores geocoding results persistently in the user's home directory under a predictable cache path without explicit disclosure. Cached AOI queries can reveal sensitive user interests or operational locations to other local users, backups, or forensic tooling.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Plaintext fallback username/password values are embedded in the module without runtime warning, which creates a secret exposure issue regardless of the internal comments discouraging direct use. Anyone who can read the repository or installed package can recover and reuse these credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends user-provided place queries directly to third-party services (Open-Meteo and Nominatim) without any explicit notice, consent flow, or local redaction. Even if the input is only a place name, it can contain sensitive location intent or private site names, resulting in unintended data disclosure to external providers.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for zh-CN without user choice. This can leak assumptions about user locale, produce unexpected region-specific results, and reduce transparency by steering external service behavior in a way the caller did not request.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 94% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15