geoskill-evapotranspiration-estimation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:09 PM UTC
• Version: 1.0.0

Overview

The main evapotranspiration tool is mostly local, but the package bundles under-disclosed network, caching, and credential-handling code that does not fit the stated offline purpose.

Install only if you are comfortable with a review-level package that advertises offline local computation but ships extra network and credential utilities. Prefer a trimmed version that removes the geocoding, downloader, credential module, hardcoded credentials, and home-directory cache, and pins dependencies before use with sensitive locations or credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions, yet the documented/runtime capabilities include file access, shell execution, environment access, and network use. This is dangerous because users and orchestrators may trust the skill to be offline and low-privilege, while the actual implementation could access local data or external services without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is a local ET estimation workflow, but the analyzed behavior reportedly includes network geocoding, home-directory caching, credential handling for multiple third-party services, hardcoded fallback credentials, and generic downloading. This mismatch is highly dangerous because it hides materially different behaviors from users, expands the attack surface, and may expose secrets or exfiltrate data under the guise of a simple offline geospatial skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored core metadata claims the embedded package belongs to a different skill ('landsat-download') than the declared evapotranspiration-estimation skill. This supply-chain inconsistency undermines provenance and makes it harder to verify that the bundled code matches the advertised functionality, potentially concealing unrelated or risky capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Including a credentials.py component in a skill whose stated purpose is offline ET computation introduces unnecessary secret-handling capability outside the declared scope. Even without direct proof of misuse in this file, such capability expands attack surface and could enable unauthorized credential access or exfiltration if the vendored code is invoked elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The vendored manifest lists download/network-oriented files such as safe_download.py and sensor-related support associated with another skill, which exceeds the advertised ET-estimation scope. Scope creep in vendored dependencies is dangerous because it can introduce hidden network behavior, enlarge the trusted code base, and mask supply-chain abuse behind unrelated functionality.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This AOI helper expands the skill’s capabilities beyond local ET estimation by sending place names to third-party geocoding services and supporting persistent caching. In a geospatial workflow this may be functionally useful, but it creates undeclared data egress and local state, which can expose sensitive user-supplied locations and violate least-privilege expectations for the skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code calls Open-Meteo and Nominatim with user-provided place queries, which is a real external communication path not obviously required by the manifest’s ET computation description. If users supply sensitive sites, project names, or private locations, those queries are disclosed to third parties without clear in-file warning or consent handling.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The default cache directory stores resolved queries under the user’s home directory, creating persistent local artifacts that may reveal searched locations over time. This is not severe code execution risk, but it is a real privacy and data-retention concern, especially on shared systems or managed environments.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module exposes credential accessors for multiple unrelated external services (OpenAI, CMA, FIRMS, EOG) even though the skill is described as ET estimation. That broadens the secret-access surface beyond least privilege and creates an opportunity for a compromised or repurposed skill path to retrieve credentials unrelated to its stated function.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The code declares support for several external-service credentials not reflected in the manifest's ET-only description. This mismatch is dangerous because users and reviewers may grant the skill trust or execution rights without understanding that it can read additional secrets from the environment and user home directory.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: In real-input mode, the skill advertises ET estimation from net radiation, air temperature, LST, and NDVI, but it actually reads only the Rn raster and synthesizes the other required variables. This creates a data-integrity vulnerability: users may trust outputs as derived from their real inputs when the results are partly fabricated, leading to incorrect scientific or operational decisions.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The output manifest and GeoTIFF metadata declare a NoData value of -9999.0, but invalid ET pixels are written as 0.0 instead. This can cause downstream tools and analysts to treat missing data as real zero evapotranspiration, silently corrupting statistics, maps, and any follow-on decisions based on those outputs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Place queries are transmitted to external services without any visible user-facing disclosure in this file, creating a privacy and transparency issue. In geospatial contexts, location queries can be sensitive operational data, so silent transmission to third parties is risky even if the feature is not malicious.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persists cache files in the user’s home directory without any evident disclosure, which can silently retain sensitive location lookups. This increases privacy risk because users may not realize their geocoding history is stored locally beyond the current run.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code contains hardcoded fallback credentials, including a username and password, inside source. Embedded secrets are inherently dangerous because they can be extracted by anyone with code access, reused outside intended contexts, and silently cause authentication to occur under a shared account without user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The Nominatim request hard-codes `Accept-Language: zh-CN,zh;q=0.9` without user choice, which can leak locale assumptions and affect returned place names or result ranking in ways the user did not request. While not severe, it is a genuine privacy/quality issue because it transmits a regional preference externally and can bias results unexpectedly.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 88% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15