geoskill-hillshade-visualization

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:31 PM UTC
• Version: 1.0.0

Overview

The main hillshade tool is local, but the package also includes under-disclosed web geocoding, credential lookup, caching, and a plaintext Earthdata password, so it should be reviewed before installation.

Install only after reviewing or removing the unused geocoding, downloader, and credential modules, rotating/removing the exposed Earthdata password, documenting any optional network/cache behavior, and pinning dependencies. The documented hillshade entrypoint appears local, but the bundled extra capabilities are broader than users would expect.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares itself as offline/local-only in its documentation, yet the static analysis indicates capabilities for environment access, file read/write, shell execution, and network use without any declared permissions. That mismatch reduces transparency and can expose local data, secrets, or system resources in ways users do not expect, especially in agent environments that rely on declared permissions for trust decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a local hillshade visualization tool, but the analyzed behavior reportedly includes geocoding, external HTTP access, downloading, and credential/secret handling, including hardcoded Earthdata fallback credentials. This is dangerous because it greatly expands the attack surface beyond the stated purpose, can leak user data or secrets, and may enable unauthorized remote access or data retrieval under the guise of a simple offline visualization skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata declares the skill as 'landsat-download' while the package being reviewed is a hillshade visualization skill. This inconsistency undermines supply-chain provenance and review integrity because auditors and tooling may validate or trust the wrong upstream component, allowing accidental or malicious code substitution to go unnoticed.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This module implements broad credential-handling capabilities well beyond a hillshade visualization skill, including support for multiple external services unrelated to the stated functionality. In a skill context, unnecessary secret-access surface increases the chance of over-privileged behavior, credential misuse, or later expansion into unintended network/data access paths.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Support for OPENAI_API_KEY is unjustified by the declared hillshade visualization purpose and creates a path for this skill to access an unrelated paid external API. In an agent environment, exposing unrelated API credentials materially increases the risk of secret exfiltration, unauthorized outbound use, or capability creep hidden behind a benign skill description.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Adding CMA, FIRMS, and EOG credential support expands the skill into unrelated external data-service access that is not justified by the hillshade-only description. Even if not directly exploited here, broad secret resolution increases attack surface and violates least-privilege expectations for a narrowly scoped visualization skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements place/AOI resolution with fallback network geocoding, which is materially outside the declared hillshade-visualization purpose. This kind of hidden scope expansion is dangerous because it introduces undeclared external data flows and behavior that users and reviewers would not expect from the manifest, making privacy, policy, and trust violations more likely.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module makes outbound HTTP requests to Open-Meteo and Nominatim even though the described skill is for hillshade visualization. Unnecessary network egress increases attack surface and can leak user-supplied place queries and usage patterns to third parties without clear justification or disclosure.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring frames the file as a compatibility shim, but the actual module provides substantial place-resolution logic unrelated to the manifested hillshade purpose. Misleading documentation impairs review and can conceal sensitive capabilities, increasing the chance that risky behavior is approved or deployed without proper scrutiny.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-supplied place queries are sent to external services (Open-Meteo and optionally Nominatim) without any notice or consent mechanism in this code path. Location queries can be sensitive, and silent transmission to third parties creates a privacy leak that is more concerning because hillshade visualization does not obviously require undisclosed external sharing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module stores resolved location manifests in a persistent cache under the user's home directory without disclosure, creating a local privacy exposure for sensitive places a user searched. Even though the cache key is hashed, the file contents include the resolved query and coordinates, so anyone with local access can recover location history.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice can disclose locale assumptions and alter third-party responses in ways the user did not request. This is primarily a privacy and user-expectation issue rather than a severe security flaw, but it still represents unnecessary transmission of preference metadata.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password, which is a direct secret-management failure. Hardcoded credentials can be extracted from source control, artifacts, logs, or package distributions and then abused for unauthorized access or account compromise.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header preferring Chinese without user opt-in or documented need. This can bias results, create unexpected behavior for non-Chinese users, and signals hidden assumptions about user context that are inconsistent with transparent, least-surprise design.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 95% confidence
• Finding: matplotlib

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
matplotlib
geopandas
shapely

• Confidence: 97% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scipy
matplotlib
geopandas
shapely

• Confidence: 95% confidence
• Finding: shapely

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15