geoskill-habitat-suitability-modeling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:29 PM UTC
• Version: 1.0.0

Overview

The advertised command is local habitat modeling, but the package includes under-disclosed geocoding, download, credential helpers, and an embedded Earthdata password, so it needs Review before installation.

Install only after reviewing or removing the unused vendored core helpers, especially credentials.py, _place.py, aoi.py, and safe_download.py. Treat the embedded Earthdata password as exposed, prefer a version with pinned dependencies and corrected vendored metadata, and do not rely on the offline privacy claim unless the network-capable helpers are absent or explicitly disabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares itself as an offline local modeling tool, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions or justification. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately assess what the skill can access, increasing the chance of unintended data exposure or command execution if supporting code is invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrowly scoped to habitat suitability modeling from local rasters, but the detected behavior includes geocoding, HTTP download utilities, unrelated remote-sensing registries, and credential management for multiple external services, including hardcoded fallback credentials. This mismatch is dangerous because hidden or unnecessary functionality expands the attack surface, can enable covert data egress or unauthorized external access, and undermines the user's ability to trust the skill's stated offline/privacy guarantees.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata claims the embedded core component belongs to a different skill ('landsat-download') than the current habitat suitability modeling skill. This indicates provenance or packaging inconsistency, which can cause reviewers and automated tooling to validate the wrong dependency set, weakening supply-chain integrity and making malicious or stale code substitution harder to detect.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends user-supplied place names to external geocoding services, creating an unintended data egress path from a skill described as local raster modeling. Even if the requests are functionally legitimate, undisclosed network access can leak sensitive locations or project intent and may violate offline or privacy expectations.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring promises ambiguous place handling via candidate return, but resolve_place automatically selects the top candidate and may further overwrite it with the first Nominatim result. This can silently direct downstream analysis to the wrong area, causing integrity failures and potentially exposing or processing data for an unintended location.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This credential module materially exceeds the stated scope of a habitat-suitability modeling skill by supporting multiple unrelated external services, including OpenAI, CMA, FIRMS, and EOG. Broader credential-handling capability increases attack surface and makes it easier for downstream code in the skill ecosystem to access sensitive tokens unrelated to the modeling task.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Supporting retrieval of an OPENAI_API_KEY in a raster-based habitat modeling skill is unjustified by the declared functionality and creates an unnecessary path to access a high-value secret. In this context, the extra capability is suspicious because it enables credential use outside the skill's documented geospatial modeling purpose.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module advertises management of credentials for several external services beyond what is needed for local RF/logistic-regression habitat suitability modeling. Even if not immediately exfiltrating data, this over-privileged design violates least privilege and increases the blast radius if any other part of the skill stack is compromised.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements place-name geocoding and outbound AOI resolution logic, which is materially different from the stated habitat suitability modeling purpose of training models from environmental rasters. Hidden or undocumented capability expansion is dangerous because it introduces unexpected network access, third-party data flows, and attack surface that users and reviewers would not anticipate from the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs outbound HTTP requests to Open-Meteo and Nominatim, sending user-supplied place queries and user-agent metadata to external services. In a skill advertised as raster-based habitat modeling, this creates an unexpected exfiltration and supply-chain surface, and allows unreviewed reliance on remote responses that may affect downstream processing or leak sensitive location intent.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: In real-input mode, the skill does not use independent species occurrence labels; it fabricates pseudo-presence labels directly from the same environmental rasters and then reports habitat suitability and cross-validation AUC as if a predictive species distribution model had been trained. This creates a self-referential model that can produce misleadingly credible outputs and QA metrics, causing users to make ecological or operational decisions based on invalid results.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The privacy documentation claims that only a non-existent `--place` option would trigger network access, while the actual code has no such option or related network path. This is a documentation-integrity and trust issue: users may rely on inaccurate privacy statements when assessing data handling and deployment risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module persists user place queries and derived AOI manifests under the user's home directory without explicit disclosure or consent. Place names and AOIs can be sensitive, and silent local retention increases privacy risk, forensic exposure, and unintended cross-project data leakage on shared systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill transmits user-provided place queries to Open-Meteo and potentially Nominatim without in-file disclosure or consent flow. In this habitat-modeling context, queried locations may reveal sensitive species study sites, conservation targets, or proprietary project areas, making the privacy impact more significant than generic geocoding.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded plaintext fallback credentials for Earthdata, including a username and password. Embedded secrets are a direct credential exposure risk: anyone with source access can reuse them, and any deployment that forgets to override them may silently authenticate with shared credentials.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scikit-learn
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scikit-learn
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scikit-learn
scipy

• Confidence: 97% confidence
• Finding: scikit-learn

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scikit-learn
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: scikit-learn

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15