geoskill-hyperspectral-unmixing

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:32 PM UTC
• Version: 1.0.0

Overview

The advertised offline hyperspectral tool includes unrelated bundled code for geocoding, downloads, local credential discovery, and hardcoded fallback credentials.

Review this before installing. The core CLI appears to perform local hyperspectral processing, but the package includes unrelated network and credential-handling modules plus hardcoded fallback credentials. Prefer an updated package that removes unused geocoding/download/credential code, rotates and deletes embedded secrets, fixes vendored provenance metadata, documents any network behavior, and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet the content and detected capabilities indicate access to environment variables, filesystem read/write, shell execution, and possible network use. This creates a trust and containment gap: users and hosting platforms may grant or assume fewer privileges than the skill actually needs, increasing the chance of unintended data access or command execution if the underlying implementation is invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a local, offline hyperspectral processing skill, but the detected behavior includes geocoding, HTTP access, file downloading, credential management for multiple services, and even hardcoded fallback credentials. This mismatch is dangerous because it conceals materially broader functionality than users expect, enabling unexpected network exfiltration, secret exposure, or abuse of embedded credentials under the cover of a benign scientific workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the package being analyzed, which breaks provenance and trust assumptions for the bundled code. In a security-sensitive plugin ecosystem, this mismatch can conceal unexpected functionality, cause reviewers to validate the wrong component, and mask supply-chain substitution or repackaging of unrelated code.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The vendored file list includes modules such as safe_download.py and credentials.py that suggest network access and secret handling capabilities unrelated to a hyperspectral unmixing skill. Extra capabilities expand the attack surface and can enable unauthorized data access, exfiltration, or hidden remote interactions if the bundled code is invoked directly or indirectly.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module sends user-supplied place names to external geocoding services, creating an unnecessary data egress path for a skill described as hyperspectral unmixing. If users provide sensitive project locations, those queries are disclosed to third-party services and may be logged externally.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code persists resolved AOI data to a cache under the user’s home directory without explicit consent. Location queries and derived AOI manifests can reveal sensitive research sites or operational areas, and persistence increases exposure to local users, backups, or later unintended reuse.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: This module is far broader than the stated hyperspectral unmixing purpose and adds generalized credential discovery for multiple third-party services, including reading environment variables, user secrets files, and .netrc entries. While breadth alone is not exploitation, in a narrowly scoped analytical skill it materially expands the sensitive-data access surface and violates least-privilege expectations.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The code embeds a real-looking fallback username and password directly in source. Hardcoded credentials are dangerous because anyone with source access can recover them, reuse them against the upstream service, and they tend to propagate into forks, logs, backups, and model context long after intended use.

Intent-Code Divergence

Critical

• Confidence: 98% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded, but the implementation does hardcode fallback credentials. This mismatch is security-relevant because reviewers and users may trust the documentation, miss the embedded secret, and deploy the skill under false assumptions about secret handling.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements place-resolution and external geocoding logic even though the advertised skill is for hyperspectral unmixing. That mismatch materially expands the skill's capabilities beyond user expectations, creating hidden data-flow and network behavior that could be abused for exfiltration or stealthy collection of location-related inputs. In this skill context, the discrepancy is more dangerous because geocoding is not obviously necessary for the declared function, so users and reviewers are less likely to expect or scrutinize it.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file makes outbound requests to third-party geocoding services, which is an unnecessary capability for a hyperspectral unmixing skill as described. Unjustified network access broadens the attack surface, enables unexpected transmission of user-supplied data, and can be repurposed as a covert communications path. The context makes this more suspicious because the capability is unrelated to the stated domain task.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Location queries are transmitted to Open-Meteo and optionally Nominatim with no user-facing disclosure in this module. Even if geocoding is functionally useful, undisclosed transmission of user-supplied place names is a privacy/security issue because sensitive locations may be exposed to external operators.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Resolved place data is written to a persistent cache file without user-facing disclosure, creating silent local retention of potentially sensitive AOI information. Persistent storage expands the attack surface because other local processes, shared accounts, or backups may access those records.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The fallback credentials look like a real account and password and are used silently, without any warning or opt-in. That creates a substantial risk of unauthorized third-party account use, accidental shared-account deployment, and secret spread into environments that never intended to use those credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-provided place queries are sent to external services via HTTP requests without any disclosure or consent mechanism in this file. Even over HTTPS, this shares potentially sensitive user intent or location information with third parties, creating privacy and compliance risk. In this context, the risk is elevated because users invoking a hyperspectral unmixing skill would not reasonably expect their inputs to be transmitted to geocoding providers.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for Chinese without user choice. This is not a memory-safety issue, but it is an unnecessary policy decision that can leak assumptions about user locale, alter returned data unexpectedly, and reduce transparency over how user queries are handled. In a skill unrelated to geocoding, this hidden behavior further increases concern because it is not aligned with the declared purpose.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 80% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 79% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 83% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15