geoskill-few-shot-classification

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:24 PM UTC
• Version: 1.0.0

Overview

The main classifier appears local, but the package also ships undocumented network, download, cache, and credential-handling modules that do not fit the offline skill description.

Install only if you are comfortable with extra bundled capabilities beyond the offline classifier. The main script appears to classify local or synthetic rasters, but the package should be revised or reviewed to remove or clearly gate the geocoding, downloader, cache, and credential modules before routine use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill declares itself as offline and privacy-preserving, yet the detected capabilities include network, shell, environment access, and file read/write without any explicit permission disclosure. This is dangerous because users and orchestrators may grant or invoke the skill under a false trust model, enabling unintended local data access or outbound communication if the implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to be an offline NumPy-equivalent classifier, but the finding indicates additional online geocoding, remote downloads, local cache management, credential handling, and even built-in Earthdata credential fallback. Hidden network access and embedded/default credentials materially expand the attack surface and can lead to data exfiltration, unauthorized remote access, or secret exposure far beyond the user-expected classification task.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file materially exceeds the stated purpose of an offline few-shot classification skill by adding AOI resolution, outbound geocoding, and persistent caching capabilities. Capability mismatch is dangerous because it expands the skill’s data access and exfiltration surface beyond what operators would reasonably expect from the manifest and description.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-supplied place queries to external services (Open-Meteo and Nominatim), creating an unexpected outbound data flow in a skill advertised as an offline NumPy-equivalent classifier. In this context, even seemingly innocuous place names can reveal sensitive user intent, locations of interest, or proprietary AOIs to third parties.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module stores persistent cache data under the user’s home directory, which introduces local data retention not implied by the skill description. Cached AOI queries can leak sensitive geographic interests or inputs to other local users, backup systems, or later processes, especially because writes occur silently and errors are suppressed.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module introduces broad credential-management capability for multiple external services, which is inconsistent with the stated purpose of an offline few-shot raster classification skill. Even without network code in this file, aggregating access to external credentials expands the skill’s privilege boundary and enables later code paths to authenticate to unrelated services.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The code is designed to read environment variables and user secret stores for several third-party services, including OpenAI, CMA, FIRMS, Earthdata, and EOG, despite the skill being described as offline. This creates unnecessary secret access scope and increases the risk of unauthorized credential harvesting or misuse by other parts of the skill.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation claims passwords are not hardcoded in skill source, but the module contains embedded fallback Earthdata credentials in `_DEFAULTS`. Hardcoded credentials in source control are directly exposable to anyone with code access and can enable unauthorized use of the linked account or service.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file introduces a full remote-download subsystem, which materially conflicts with the stated purpose of an offline NumPy-equivalent classifier. In a skill that should operate locally, hidden network retrieval expands the attack surface for data exfiltration, remote payload fetching, and policy bypass, especially because the capability is reusable and vendored into skills.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The `_http_get` implementation provides generic HTTP download capability unrelated to the advertised offline classifier behavior. In context, this makes the skill more dangerous because it can fetch arbitrary remote content at runtime, enabling unreviewed behavior changes or retrieval of malicious models/data without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: `safe_download` and `safe_download_many` write fetched content to caller-controlled filesystem paths, which exceeds the minimal needs of an offline classifier and can be abused to place arbitrary files in accessible locations. Although this is not privilege escalation by itself, in a larger agent environment it could overwrite or stage files that influence later execution or corrupt local data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The public API claims an offline classification-related skill, but this function delegates to a place-resolution path that can perform geocoding and external network access. This creates undisclosed data egress and materially expands the skill’s capabilities beyond its stated purpose, which is dangerous in agent environments where users and reviewers rely on metadata to understand what code may transmit externally.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: These functions issue HTTP requests to Open-Meteo and Nominatim despite the skill being described as an offline NumPy-equivalent implementation. Hidden outbound requests can leak user-supplied place names, environment-derived behavior, and usage patterns to third parties, violating least surprise and undermining trust in sandboxed or offline workflows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file implements broad geocoding logic unrelated to a few-shot raster classification skill, including query normalization, remote lookup, scoring, and fallback resolution. This capability mismatch increases attack surface and enables unexpected data exfiltration or policy bypass because the skill can contact external services under a misleading functional label.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module header says it is merely a compatibility adapter, but the file still contains and can execute a complete legacy network-enabled implementation on fallback. This discrepancy impedes security review and can mislead operators into believing the file is low-risk glue code when it actually preserves full outbound-request behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Queries are transmitted to third-party geocoding providers without any user-facing warning in this file, which creates a privacy and compliance risk. In a skill explicitly described as offline classification, undisclosed network transmission is more dangerous because users are less likely to anticipate or consent to external disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing the Accept-Language header to a Chinese locale without user opt-in can leak assumptions about user language or region and alters third-party processing in a way the user did not request. This is primarily a privacy and policy issue rather than a severe technical exploit, but it is still inappropriate in a mismatched offline-classification skill.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Storing fallback credentials directly in source code creates a persistent secret exposure risk, especially when there is no warning, disclosure, or runtime prompt to users. Anyone inspecting the repository or package can recover and misuse the credentials.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The module automatically reads `~/.geoskill/secrets.json` on first use, which silently expands access to locally stored secrets. While local secret loading is a common pattern, doing so automatically in a skill advertised as offline and unrelated to these services increases surprise and the potential for unreviewed secret access.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The request hard-codes an Accept-Language preference for Chinese without user consent or clear necessity. While not a direct code-execution flaw, it can influence remote service behavior, reveal locale assumptions, and create privacy or policy concerns by transmitting regional preferences that are unrelated to the declared offline classification purpose.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 84% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15