geoskill-extreme-weather-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:09 PM UTC
• Version: 1.0.0

Overview

The main weather detector appears local, but the package includes under-disclosed network and credential-handling code unrelated to that purpose.

Review before installing. The normal entrypoint appears to perform local extreme-weather analysis, but the package should remove or clearly disclose the unrelated geocoding, download, and credential modules, remove and rotate the hardcoded Earthdata credentials, avoid reading unrelated local secrets, make any network/cache behavior opt-in, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares an offline, local-only workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. That gap is dangerous because users and policy layers cannot accurately assess or constrain what the skill may do, increasing the chance of unintended data access, command execution, or outbound communication.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as an offline percentile-threshold detector, but analysis indicates geocoding, remote downloads, credential handling, and even hardcoded fallback credentials unrelated to the stated purpose. Hidden network/data-access behavior and embedded credentials materially raise the risk of secret exposure, unauthorized external communication, and abuse of third-party services under the guise of a benign local analytics tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata shows the package includes a different skill, 'landsat-download', rather than code clearly aligned with extreme-weather detection. That mismatch is a supply-chain and capability-transparency risk because hidden or unrelated components can introduce unexpected behavior, data access, or network activity that users of this skill would not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The metadata references modules such as credentials.py and safe_download.py, indicating credential handling and download capabilities that are not obviously necessary for a percentile-based weather-event detector. In this context, extra credential and network functionality expands the attack surface and could enable unnecessary secret access or remote data retrieval paths if the vendored code is invoked.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module sends user-supplied place names to third-party geocoding services and also supports persistent local caching, which expands data exposure beyond a purely local AOI parser. In a weather-detection skill this is a real security/privacy concern because location queries may contain sensitive user intent or operational geography, and the file does not enforce explicit consent, offline-only mode, or strong minimization.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The credential module is broader than the stated extreme-weather detection scope and exposes access paths for unrelated services such as OpenAI and EOG. In a skill environment, unnecessary credential-handling increases the blast radius: any downstream code that imports this helper can access more secrets than required, violating least privilege and making accidental or malicious exfiltration easier.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The module explicitly supports retrieval of OPENAI_API_KEY despite no justification in the skill description for using an LLM provider. Unused access to high-value API credentials is dangerous because it creates an unnecessary secret-access surface that can be abused by other code paths or future changes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module includes EOG_USERNAME/EOG_PASSWORD retrieval even though the skill is described as extreme-weather detection, not night-light or EOG data access. This unnecessary credential access broadens the set of local secrets the skill can read and increases exposure without clear functional need.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring claims passwords are not cached, but load_user_secrets writes secrets into the module-global _DEFAULTS dict and reuses them for later lookups. This mismatch is security-relevant because operators may rely on the documentation when assessing memory lifetime and exposure of credentials in long-running processes.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The get_earthdata_token docstring states that the .netrc account field is part of token resolution, but the implementation only calls _resolve("EARTHDATA_TOKEN") and never parses account from .netrc. Security-sensitive documentation inaccuracies can cause users to misconfigure credentials, fall back to weaker defaults, or make incorrect assumptions about where secrets are sourced.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The legacy fallback makes outbound requests to third-party geocoding services, which expands the skill's effective capability beyond the stated manifest and leaks user-supplied place queries to external providers. Hidden or undocumented network egress is security-relevant because operators may believe the skill is local/offline while it actually transmits potentially sensitive location inputs and depends on remote services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Place queries are transmitted to external services without any user-facing warning in this file, which is a genuine privacy issue. Even if only location strings are sent, these can reveal sensitive areas of interest, and the lack of transparency makes the data disclosure harder for users and integrators to assess or control.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: Resolved place data is written under a persistent cache directory in the user's home folder without any disclosure or retention policy. While the cached content is limited, it can still reveal prior queried locations and therefore creates a local privacy leak, especially on shared systems or multi-user environments.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This file hardcodes a real-looking fallback username and password in source code. Hardcoded credentials are a severe secret-management failure: anyone with repository or package access can reuse them, and the skill may silently authenticate with embedded credentials without user knowledge.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15