geoskill-glacier-retreat-monitoring

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:29 PM UTC
• Version: 1.0.0

Overview

The main glacier tool is mostly local, but the package also bundles undisclosed network geocoding, home-directory caching, and credential-handling code that does not fit the stated offline purpose.

Review this package before installing if you need an offline-only skill. The visible glacier CLI appears local, but the package contains extra geocoding, network download, credential, and cache helpers that are not disclosed in the user-facing skill description. Remove or disable those helpers, rotate any embedded credentials, and pin dependencies before treating it as production-safe.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares itself as fully offline and permissionless, yet the analysis indicates capabilities for environment access, file read/write, network, and shell use. That mismatch can mislead users and reviewers about the actual trust boundary, increasing the risk of unintended data exposure, command execution, or network egress if the implementation is invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: a glacier-analysis skill presented as local/offline apparently also performs geocoding, remote downloads, credential handling, and contains embedded fallback secrets. Hidden network access and bundled credentials materially expand the attack surface and can enable secret leakage, unauthorized third-party access, unexpected data exfiltration, or supply-chain abuse.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The exported resolve_place API delegates to geocoding functionality in _geoskill_core.aoi and exposes parameters for network lookups, which is outside the manifest-described glacier-retreat analysis scope. Scope expansion is dangerous because it allows the skill to process arbitrary place-name inputs and potentially transmit user-supplied locations to external services, increasing privacy and supply-chain risk without clear user expectation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The legacy fallback contains full network geocoding implementations for Open-Meteo and Nominatim, enabling outbound requests and arbitrary place resolution even when the core module fails. This materially broadens the skill's capabilities beyond glacier analysis and creates hidden external-data flows, which can leak sensitive user queries, bypass intended control paths, and make behavior differ depending on runtime failure conditions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code provides context-inappropriate arbitrary geocoding over the network through _open_meteo_search and _nominatim_search, accepting user-controlled queries and sending them to third-party services. In a glacier-monitoring skill, this is more dangerous because users would not reasonably expect general-purpose geocoding capability or associated external disclosure of their inputs.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: User-supplied place queries are transmitted to external geocoding services without any notice or consent mechanism in this code. That can leak sensitive research targets, field locations, or operational interests to third parties, which is especially relevant for geospatial workflows where location names themselves may be sensitive.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Resolved place data is written into a persistent cache under the user's home directory without disclosure or explicit opt-in. This can leave a local trail of sensitive AOI queries and locations that other local users, backups, or forensic tooling could later recover.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The source code contains hardcoded fallback credentials for NASA Earthdata, including a plaintext username and password. Embedded credentials are dangerous because anyone with source access can reuse them, and the module automatically falls back to them when environment or user secrets are absent, enabling unintended authenticated access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely
matplotlib

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely
matplotlib

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely
matplotlib

• Confidence: 97% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scipy
geopandas
shapely
matplotlib

• Confidence: 97% confidence
• Finding: matplotlib

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 75% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15