geoskill-groundwater-level-prediction

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:29 PM UTC
• Version: 1.0.0

Overview

The main groundwater prediction tool is mostly local, but the package includes undisclosed credential and network helper code, including a plaintext external-service password.

Install only after the publisher removes and rotates the embedded Earthdata credentials, documents or removes the unused network/download/geocoding helpers, and pins dependencies. If you still test it, run only the documented main script with explicit --bbox or local --input data and avoid giving it access to personal credential files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata shows this skill bundles a different capability, 'landsat-download', rather than something clearly limited to groundwater prediction. That mismatch expands the skill’s effective capability surface to include satellite acquisition logic, which can introduce unnecessary network, file-handling, and data-access behaviors not justified by the declared purpose, making review and safe deployment harder.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The presence of modules such as safe_download.py and credentials.py indicates external download and secret-handling capabilities inside a skill whose stated function is predictive modeling for groundwater levels. Even without direct proof of abuse in this file, bundling these capabilities unnecessarily increases the risk of unexpected outbound access, secret misuse, or hidden data acquisition paths that operators may not anticipate from the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code persistently stores resolved place queries and AOI manifests under the user's home directory by default, which can leak sensitive project locations or research targets to local disk without explicit user awareness. Even though this is not remotely exploitable by itself, it creates a privacy and data-handling risk because geospatial queries may reveal confidential sites or operational interests.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The docstring claims passwords are not hardcoded, yet the module contains a plaintext Earthdata username and password in `_DEFAULTS`. This creates immediate credential exposure to anyone with source access and can lead to unauthorized use of the associated external account, plus downstream compromise if the password is reused elsewhere. The contradiction also suggests deliberate concealment or at minimum seriously negligent secret handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User-supplied place names are sent to third-party geocoding services without any user-facing disclosure in this module, which can expose sensitive locations, study areas, or customer sites. In a groundwater prediction skill, AOI names may be operationally sensitive, so silent transmission to external services is a real privacy risk even if the network use is functionally justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module writes cached query results into ~/.geoskill_core_cache without clear disclosure, preserving user place queries and derived AOI metadata on disk. For geospatial workflows, these cached entries can reveal sensitive locations long after execution, increasing exposure to local users, backups, or forensic recovery.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The `_DEFAULTS` dictionary embeds a plaintext username and password as fallback credentials. Hardcoded secrets are a direct secret-disclosure vulnerability because anyone who can read the repository, package, logs, or build artifacts can recover and abuse them, especially dangerous here because the module is designed to centralize and normalize credential access.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN/zh without user choice, causing user queries to be processed under an implicitly forced locale. This can leak user preference assumptions, produce region-biased results, and create privacy or compliance issues when handling users outside the expected Chinese-language context.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 92% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
scikit-learn

• Confidence: 97% confidence
• Finding: scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15