Geoskill: GPM Download Test

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:15 AM UTC
• Version: 5.0.2

Overview

The GPM downloader is mostly coherent, but it ships an unrelated credential helper with real-looking hardcoded Earthdata credentials and local secret-reading behavior that is not disclosed in the main skill description.

Review this skill carefully before installing. The main downloader appears to fetch public NASA GPM data and write local outputs, but the package should remove the unused credential helper or at least remove hardcoded credentials and clearly disclose any local secret or netrc access. Do not rely on the current no-auth/no-credentials description as applying to every bundled module.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module documentation states that antimeridian-crossing bounding boxes must be rejected unless specially handled, but the implementation only flags longitudes outside [-180, 180] and separately treats W>=E as a generic ordering error. As a result, a valid antimeridian-crossing bbox such as [170, -10, -170, 10] is not explicitly recognized as dateline wrap-around, which can lead downstream code to compute incorrect extents or areas while assuming the safety check enforced the documented invariant.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring says scale/offset must be explicit, but full_raster_check only validates them if one of the values is already supplied and never emits an issue when both are absent. This creates a contract gap where callers may believe products were checked for explicit scale/offset metadata when they were not, increasing the risk of downstream misinterpretation of raster values and silent scientific/data integrity errors.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly claims passwords are not hardcoded in source, yet `_DEFAULTS` contains a real-looking Earthdata username and password. Hardcoded credentials in source are a direct secret exposure risk, and the misleading documentation increases operational risk because reviewers and users may incorrectly assume the code is safe.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The documentation says credentials are not cached and are read on each call, but `load_user_secrets()` copies secrets into `_DEFAULTS` and retains them in process memory behind `_user_secrets_loaded`. This inconsistency weakens secret-handling guarantees and increases exposure in long-lived processes, memory dumps, or accidental introspection.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code embeds fallback credentials directly in `_DEFAULTS`, so any runtime that lacks overriding environment values may silently authenticate with shared hardcoded credentials. This creates unauthorized account reuse, secret leakage through source distribution, and difficult-to-detect cross-user access under a common identity.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:18