Geoskill: GEE Dataset Intel V1 Final

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:07 AM UTC
• Version: 5.0.1

Overview

The skill mostly fits its GEE dataset-search purpose, but it needs Review because it ships hardcoded fallback credentials and under-discloses some external lookup and credential behavior.

Install only if you are comfortable with a skill that can run update/audit scripts, make external requests for refresh, geocoding, source review, and optional LLM audit, and write local catalog/report/cache files. Do not use the bundled hardcoded Earthdata fallback credentials; remove or override them before any authenticated workflow, and avoid --place or --enable-llm for sensitive locations or private metadata unless external disclosure is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that include environment-variable access, shell execution, local file reads/writes, and explicit network operations, yet no declared permissions boundary is provided. This creates a least-privilege and transparency problem: users or hosting systems may authorize the skill under the assumption it is read-only dataset search, while it can also mutate local assets, call external services, and use credentials from the environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is dataset search/recommendation, but the skill also documents much broader behaviors including crawling remote sources, geocoding, auditing via third-party LLMs, credential use, downloading files, and writing reports/overrides. That mismatch is dangerous because it undermines informed consent and makes it easier to trigger unexpected external requests, credential exposure paths, or local state changes in contexts that expect a simple offline lookup tool.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The credentials section states that only optional translation needs an OpenAI-compatible API key, but earlier documentation shows the LLM-backed spatial audit also requires an API key and can send metadata to an external endpoint. This inconsistency can mislead operators about when secrets are needed and when data leaves the environment, increasing the chance of accidental credential provisioning or unintended external transmission.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The module sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive location queries to external parties without any consent flow in this file. In a dataset-intelligence skill, that data transfer is not strictly necessary to explain datasets and creates an avoidable privacy exposure, especially for precise or confidential AOI names.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The code stores persistent cache data under the user's home directory, which can retain sensitive place queries and resolved AOI data beyond the current session. While this is not an active exploit primitive, it creates privacy and local data exposure risk on shared systems or in environments where home directories are backed up, synced, or accessible to other tooling.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback Earthdata username and password in source code. Embedded credentials create an immediate secret exposure risk to anyone with repository or package access, and they also enable silent authenticated access without the user's knowledge.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded in skill source, yet the module embeds default Earthdata credentials. This mismatch is dangerous because it misleads reviewers and users, reducing scrutiny around a real secret and masking unauthorized credential use.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The resolver performs an online fallback via `_geoskill_aoi.resolve_place(... allow_nominatim=True ...)`, which adds external network capability and sends user-supplied place data to a third-party geocoding service. In a dataset-intelligence skill, this expands the trust boundary and can create privacy, policy, and availability risks, especially because the behavior is enabled by default and the broad `except Exception: pass` hides failures and network use from callers.

Description-Behavior Mismatch

Medium

• Confidence: 77% confidence
• Finding: The script can write generated audit overrides back into the assets directory, modifying repository data rather than operating read-only. In a skill advertised as search/filter/recommend/explain, this expands capability into content mutation, which can corrupt downstream metadata or silently alter results if run with write access.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends candidate dataset metadata to a configurable external LLM endpoint, creating a data egress path outside the stated skill purpose. Even if the metadata is intended to be public, configurable endpoints and external transmission increase supply-chain and privacy risk, especially if future records contain internal annotations or non-public fields.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These network requests transmit raw user-provided place queries to external services without any user-facing warning, which is a privacy/security concern because location intent can itself be sensitive. Even if the providers are legitimate, silent exfiltration of user queries violates least surprise and may breach user expectations or organizational data-handling rules.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Writing cache files under the user's home directory without warning can persist sensitive query history and AOI metadata unexpectedly, making later disclosure possible through local compromise, shared accounts, backups, or support bundles. The risk is elevated because the code silently enables this behavior through a default cache directory rather than requiring consent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code embeds fallback username and password without any runtime disclosure or consent flow. Users may unknowingly run operations under someone else's account, while the exposed credentials remain recoverable from source history and distributed artifacts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When hardcoded matching fails, the code may transmit raw user-provided place queries to an external geocoder without any disclosure in this file or consent mechanism. That can leak sensitive location intent or operational context, and because `use_nominatim` defaults to `True`, callers may trigger this behavior unintentionally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The help text states that --place resolution may use Open-Meteo and Nominatim, meaning user-supplied place names can be sent to external services. This creates a real privacy/data-egress issue because potentially sensitive query terms may leave the local environment without a strong runtime warning or explicit consent at execution time.

External Transmission

Medium

• Category: Data Exfiltration

Content

python scripts\audit_catalog.py

# Optional network audit: set GEE_AUDIT_API_KEY in this shell first
$env:GEE_AUDIT_BASE_URL = 'https://api.minimaxi.com/v1'
$env:GEE_AUDIT_MODEL = 'MiniMax-M3'
$env:GEE_AUDIT_API_STYLE = 'openai'
python scripts\audit_catalog.py `

• Confidence: 82% confidence
• Finding: https://api.minimaxi.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

from gee_catalog import Catalog, DEFAULT_ASSETS_DIR, clean_text, normalize_text


DEFAULT_BASE_URL = "https://api.minimaxi.com/v1"
DEFAULT_MODEL = "MiniMax-M3"
DEFAULT_API_STYLE = "openai"
USER_AGENT = "gee-dataset-intelligence-audit/1.0"

• Confidence: 84% confidence
• Finding: https://api.minimaxi.com/

Unpinned Dependencies

Low

• Category: Supply Chain

Content

gee_catalog

• Confidence: 97% confidence
• Finding: gee_catalog

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_query_catalog.py:20