geoskill-heatwave-impact-assessment

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:30 PM UTC
• Version: 1.0.0

Overview

The skill mostly performs local heatwave analysis, but it bundles undisclosed network, caching, and credential-handling code that does not fit the offline privacy claims.

Install only if you are comfortable reviewing or removing the bundled geocoding, downloader, and credentials helpers first. Treat outputs from real temperature inputs as partially synthetic unless you separately supply or validate real population and humidity data; do not use those exposure or wet-bulb results for operational decisions without that validation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions, yet static analysis detected capabilities for environment access, file read/write, network, and shell execution. Even though the markdown claims offline/local behavior, undeclared powerful capabilities reduce transparency and can enable unexpected data access, command execution, or outbound communication if the underlying implementation uses them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as an offline geospatial heatwave analysis tool, but analysis indicates additional functionality for network geocoding/downloading, credential handling for multiple external services, and even embedded fallback credentials. Hidden remote access and credential features are especially dangerous here because users are likely to trust the privacy/offline claims and may expose local data or unintentionally use hardcoded secrets.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The AOI helper sends user-provided place names to external geocoding services and also persists results to a local cache directory, but the skill description only discusses heatwave analysis outputs and does not disclose these side effects. This creates an unexpected data egress and local data retention path that can expose sensitive location queries, especially if users assume analysis is local or offline-first.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The public API exposes place-name resolution with configurable network-backed geocoding, but the skill description only advertises heatwave analytics outputs. That mismatch creates an undisclosed data flow where user-supplied locations may be sent to external resolvers, which is a security and privacy concern because operators and users cannot accurately assess what the skill transmits off-box.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The legacy fallback path performs outbound HTTP requests to Open-Meteo and Nominatim, extending behavior beyond the manifest's stated local analytical purpose. This is dangerous because fallback code can silently exfiltrate sensitive place queries to third parties and may bypass governance controls that rely on the declared capability set.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: In real-input mode, the skill reads only the temperature raster but silently fabricates population and humidity layers via generate_synthetic(), then uses those synthetic layers to compute exposed population, vulnerability, and wet-bulb risk outputs. This is a true integrity vulnerability because downstream users may trust these outputs as real-world assessments, leading to materially false public-health or planning decisions without any clear failure or warning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes cached geocoding results keyed by user queries into a persistent directory under the user's home folder without any disclosure in this file. Place names can reveal sensitive interests, home/work locations, or protected activities, and long-lived local storage increases exposure to other local users, backups, or later compromise.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: User-supplied place input is transmitted to third-party geocoding endpoints without an explicit warning or consent path in this code file. Location queries are often sensitive, and external transmission can expose them to service operators, logs, network monitors, and cross-jurisdictional processing.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for Chinese without user opt-in. This is primarily a privacy and policy issue rather than a direct exploit primitive: it may leak inferred user locale/preferences, bias returned results, and create unexpected behavior for non-Chinese users.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Even if described as defaults, embedding live-looking credentials in source creates immediate secret exposure risk, encourages credential reuse, and can enable unauthorized access wherever the code is distributed or logged.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The Nominatim request forces an Accept-Language preference of zh-CN regardless of user choice or locale. While not code-execution dangerous, it can leak assumptions about target users, alter returned place data, and create unnecessary privacy and correctness issues by transmitting a fixed regional preference to an external service.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15