geoskill-green-infrastructure-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:28 PM UTC
• Version: 1.0.0

Overview

The main mapping tool is local, but the package also includes undisclosed credential and network helper code that is broader than the advertised offline NDVI workflow.

Review before installing. The documented mapping command appears local, but the package ships extra helper code that can use network services and local credential stores if invoked. Install only if you trust the publisher and are comfortable with the bundled credential/geocoding helpers, or remove/disable those helpers and hardcoded credentials before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions while static analysis detected capabilities for environment access, file read/write, network, and shell execution. This is dangerous because users and orchestrators may treat the skill as local/offline and low-risk, when it may actually access sensitive files, invoke commands, or communicate externally without explicit disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior says the skill performs offline green-infrastructure mapping, but the analyzed behavior includes geocoding, external HTTP downloads, multiple third-party service integrations, credential handling, and embedded fallback credentials. This mismatch is highly dangerous because it can conceal data exfiltration, unauthorized network access, and secret misuse behind an innocuous geospatial-processing description, especially given the privacy claims that processing is local and data is never uploaded.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This credential module materially expands the skill’s capability surface beyond the stated green-infrastructure mapping purpose by handling multiple external services and secret types, including OpenAI, CMA, and EOG credentials. In a skill context, broad secret brokerage increases the chance that downstream code can access unrelated user credentials and use them for out-of-scope network actions, making compromise or misuse more damaging.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: CMA and EOG credential support appears broader than what is needed for the declared NDVI/tree-crown/green-space mapping workflow. Pulling in extra credential types normalizes access to unrelated accounts and enlarges the blast radius if the skill or a dependent component is abused.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: CMA and EOG credential support appears broader than what is needed for the declared NDVI/tree-crown/green-space mapping workflow. Pulling in extra credential types normalizes access to unrelated accounts and enlarges the blast radius if the skill or a dependent component is abused.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims passwords are not cached, but load_user_secrets() copies user secrets into the module-level _DEFAULTS dictionary and reuses them for the life of the process. This mismatch can cause operators to underestimate memory-residency risk and may leave sensitive credentials accessible to other code in-process longer than intended.

Description-Behavior Mismatch

Medium

• Confidence: 74% confidence
• Finding: The legacy fallback silently makes outbound requests to third-party geocoding services (Open-Meteo and Nominatim) when the core module is unavailable, which can transmit user-supplied place queries off-platform without clear disclosure in the stated skill scope. In a mapping workflow, place names may reveal sensitive user interests or locations, so an undisclosed network fallback increases privacy and supply-chain risk even if the code is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: User-provided place names are sent to third-party geocoding services without any explicit disclosure or consent mechanism. Place queries can contain sensitive or identifying location information, so silent transmission to external providers creates a privacy and data-handling risk, especially in an 'offline-first' helper where users may not expect network sharing.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback Earthdata credentials with a real-looking username and password. Hardcoded secrets are dangerous because they may be valid, get reused unintentionally across environments, leak through source distribution, and provide silent network authentication without user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Forcing the Accept-Language header to zh-CN on Nominatim requests overrides user locale without consent and may unnecessarily reveal regional assumptions or influence provider responses in unexpected ways. This is mainly a privacy and correctness issue rather than a direct compromise primitive, but it can affect output integrity and user expectations.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 92% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 92% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 90% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 93% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15