geoskill-fire-weather-index

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:21 PM UTC
• Version: 1.0.0

Overview

The main fire-weather tool appears local, but the package includes under-disclosed network, cache, and credential helper code that users should review before installing.

Review this before installing in sensitive environments. The documented FWI command itself looks local/offline, but the package should remove or clearly disclose the unused geocoding, downloader, cache, and credential helpers, delete the hardcoded Earthdata credentials, correct the vendored provenance, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises offline/local processing and declares no permissions, yet static analysis detected capabilities for environment access, file I/O, network, and shell. This creates a trust and transparency gap: users may grant or run the skill under false assumptions, increasing the chance of unexpected data access or command execution if the underlying implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a substantial description-behavior mismatch: the skill claims to compute FWI from local meteorological inputs, but analysis indicates additional generic capabilities including geocoding, network queries, downloading, credential management, and even default credential fallback. Such hidden functionality materially expands the attack surface and could enable data exfiltration, unauthorized remote access, or misuse of embedded credentials far beyond the stated fire-weather use case.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The vendored manifest claims the embedded core package belongs to a different skill ('landsat-download') than the current fire-weather-index skill. This indicates a supply-chain integrity or packaging mismatch: the wrong vendored component may have been copied in, or metadata may have been altered, making provenance and review unreliable. In a geospatial skill, reused core code may still execute with network/filesystem access, so misidentification reduces trust and can mask unintended or risky functionality.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This AOI helper performs network geocoding to third-party services and persists results to local cache files, which expands the skill's behavior beyond pure fire-weather-index computation into data egress and local state modification. Even if functionally useful, transmitting user-supplied place names and storing resolved locations without explicit disclosure can leak sensitive operational context such as target areas of interest.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The module embeds a real-looking fallback Earthdata username and password, enabling unauthorized external service access whenever environment variables or user secrets are absent. In a shared or published skill, hardcoded credentials can be harvested and abused by anyone with source access, and the fallback silently widens the skill's permissions beyond the user's explicit configuration.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The docstring states that passwords are not hardcoded, but the code later hardcodes fallback Earthdata credentials. This contradiction is dangerous because reviewers and operators may trust the documentation and miss the embedded secret, allowing long-lived credential exposure and unintended service access.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The exported resolve_place() API performs place-name resolution and may invoke network-backed geocoding through _geoskill_core.aoi, which is outside the manifest's stated fire-weather-index computation scope. This creates hidden data egress and external dependency behavior that users and orchestrators may not expect, especially when location inputs are sensitive or when skills are assumed to be offline/compute-only.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The legacy fallback directly issues HTTP requests to Open-Meteo and Nominatim, meaning the skill transmits user-supplied place names to third-party services even when the core module is unavailable. Because this behavior is not reflected in the manifest description, it can bypass user expectations, compliance controls, or deployment policies that rely on manifest-declared capabilities.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-supplied place queries are sent to Open-Meteo and optionally Nominatim without any in-code disclosure, consent flow, or privacy guardrails. In this skill context, AOIs may reflect sensitive locations related to monitoring, planning, or incident response, so silent third-party transmission can expose operationally relevant information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module writes resolved AOI manifests to a persistent cache under the user's home directory without any user-facing disclosure or consent. Cached place names and bounding boxes can reveal historical areas of interest to other local users, backup systems, or forensic review, which is a privacy and data-handling risk.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The hardcoded fallback credentials appear to be usable account credentials and are automatically consumed at runtime without requiring explicit user consent. This creates immediate risk of credential leakage, unauthorized API consumption, account takeover/abuse, and difficult-to-detect use of someone else's identity in automated workflows.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The Nominatim request hardcodes Accept-Language to zh-CN,zh without user choice, which can leak locale assumptions and influence service responses in a way the user did not request. While not a code-execution flaw, it is a privacy and correctness issue because it may reveal inferred language/region preferences and produce biased or unexpected geocoding results.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15