geoskill-generative-adversarial-rs

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:26 PM UTC
• Version: 1.0.0

Overview

The main image-processing script is mostly coherent, but the package includes under-disclosed network geocoding and credential-handling code, including a hardcoded password.

Review this package before installing in an environment with real credentials or sensitive location interests. The documented CLI appears local, but the bundled helper modules should be removed or clearly disabled unless you intentionally need geocoding, downloads, and credential lookup; the exposed Earthdata fallback credential should also be treated as compromised.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares itself as local/offline imagery processing, yet the detected capabilities include environment access, file read/write, shell, and network without any corresponding permission disclosure. This creates a transparency and trust problem: users may execute the skill expecting only local GAN inference, while it may access broader system resources than the description suggests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill is presented as a GAN-based remote-sensing tool, but the analyzed behavior includes network geocoding, external HTTP access, downloads, credential handling for multiple third-party services, and even hardcoded fallback credentials. Hidden network reachability and embedded credentials materially expand the attack surface and can lead to secret leakage, unauthorized service use, or unexpected data exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored metadata claims this package belongs to a different skill ('landsat-download') than the stated GAN cloud-removal/image-enhancement skill. This kind of provenance mismatch undermines integrity checks, can confuse reviewers and automation, and may hide copied or substituted components that were not actually reviewed for this skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file performs outbound HTTP geocoding requests to Open-Meteo and Nominatim, which is materially outside the stated scope of a GAN cloud-removal/image-enhancement skill. Even if functionally useful for AOI selection, unexpected network access can leak user-supplied place names and expand the attack surface through third-party dependencies and remote services.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code persistently stores resolved queries and manifests under the user's home directory in ~/.geoskill_core_cache without any consent or manifest-scoped justification. This can retain sensitive location interests over time and introduces undeclared filesystem side effects for a skill advertised only for model training/inference.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: External geocoding capability is context-inappropriate for a GAN image-enhancement skill and broadens what the component can do beyond user expectations. In this context, the mismatch itself is security-relevant because users may not anticipate that place names are transmitted to remote services and combined with local persistent caching.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module is a real security issue because it embeds hardcoded fallback credentials for external services, including a plaintext Earthdata username and password, and centralizes access to multiple unrelated secrets. In a skill whose stated purpose is GAN cloud removal/image enhancement, broad credential-resolution logic for Earthdata, FIRMS, CMA, EOG, and OpenAI materially expands access beyond expected scope and increases the chance of unauthorized credential use or secret exposure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Support for retrieving an OpenAI API key is unnecessary for the declared GAN training/inference purpose and widens the secret-access surface without clear justification. Even without direct exfiltration in this file, unnecessary secret access is dangerous because other parts of the skill can reuse this helper to consume or leak unrelated credentials.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims passwords are not cached, but `load_user_secrets()` copies secrets into the module-global `_DEFAULTS` dictionary and keeps them for the process lifetime. This mismatch is security-relevant because operators may rely on the claim when evaluating memory exposure, process dumps, or long-lived service risk.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The exported resolve_place API adds place-resolution behavior that is unrelated to the skill’s declared GAN cloud-removal/image-enhancement purpose. In a mismatched skill context, hidden or undocumented location-resolution functionality increases the attack surface, can trigger unexpected outbound data flows, and may be used to process user-supplied place data without clear need or consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code performs outbound requests to third-party geocoding services (Open-Meteo and Nominatim) even though the skill is described as an image-processing GAN. Unnecessary network access can exfiltrate user-provided place names, create privacy/compliance issues, and expose the environment to dependency and availability risks unrelated to the advertised function.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module header describes legacy compatibility and delegation to AOI/place-resolution code, which contradicts the skill’s stated GAN-focused purpose. This kind of capability drift is dangerous because it can conceal extra functionality from reviewers and users, making unauthorized networked behavior harder to detect and govern.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: Automatically triggering GPU training and writing model weights on first run can cause unexpected resource consumption, long runtimes, and unanticipated disk modifications. In shared or cost-sensitive environments, this may lead to denial-of-service-like effects, budget overrun, or operational surprise because users may think they are only running inference.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User place queries are sent to external geocoding providers without any disclosure or consent mechanism in this code path. Location queries can be sensitive personal or operational data, so silent transmission to third parties creates a privacy and supply-chain exposure that is more concerning given the skill's unrelated advertised purpose.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The default cache path in the user's home directory means resolved location queries may be retained persistently without user-facing notice. Even though the file stores hashed filenames, the manifest contents written to disk still include the original query and resolved location data, creating a privacy risk.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for zh-CN/zh without user choice. While not a direct code-execution flaw, it can leak assumptions about locale, affect returned data in unexpected ways, and create privacy or policy concerns when requests are sent to external services without explicit user opt-in.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 95% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 95% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15