Security audit
Security checks across malware telemetry and agentic risk
The skill appears to perform local geometric correction, but it also ships undisclosed credential, downloader, geocoding, and hardcoded-password code that does not fit the advertised purpose.
Review this carefully before installing. The main script may work as an offline raster correction utility, but the package should remove or clearly isolate the unrelated network, downloader, and credential modules, delete and rotate the hardcoded Earthdata credentials, and document any network or secret access before it is suitable for normal use.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy
numpy rasterio scipy
numpy rasterio scipy
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution