geoskill-idw-interpolation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:34 PM UTC
• Version: 1.0.0

Overview

The advertised IDW tool is mostly local, but the package also contains undisclosed network, downloader, cache, and credential-handling code that does not fit the stated offline purpose.

Review this package carefully before installing. The documented IDW command appears local, but the package includes extra geospatial core helpers that can make network requests, write a home-directory cache, read credential stores, and use embedded service credentials. Install only if you trust the publisher and are comfortable with those bundled capabilities, or remove the unrelated helper modules before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documentation declares an offline/local IDW interpolation tool, but the static analysis indicates capabilities for environment access, file read/write, shell, and network without any declared permissions. Undeclared powerful capabilities reduce transparency and prevent users from making informed trust decisions, especially when the skill also claims it makes no network requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a significant description-behavior mismatch: the skill is presented as a simple offline geospatial interpolation utility, yet analysis indicates geocoding, external network access, downloading, registry/metadata handling, and credential collection from environment variables, .netrc, and secrets files, including embedded Earthdata credentials. Hidden network and credential-handling functionality in a data-processing skill materially increases the risk of secret exposure, unexpected data egress, and supply-chain style abuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored core metadata claims the bundled core belongs to a different skill ('landsat-download') while this package is an IDW interpolation skill. This creates a supply-chain integrity problem: reviewers and automation can no longer reliably determine what code was vendored for this skill, which can hide accidental or unauthorized code reuse and undermine provenance checks.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The helper performs outbound geocoding requests and persists query results to a local cache, which exceeds the stated scope of an IDW interpolation skill and creates unnecessary data exposure. Even if not overtly malicious, unexpected network I/O and disk writes can leak user-supplied place names, violate least-privilege expectations, and surprise operators in offline or privacy-sensitive environments.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: Embedding external geocoding capability in a skill described only as IDW interpolation broadens the trust boundary and adds undeclared external dependencies. This is dangerous mainly because it can transmit user input to third parties and change the runtime behavior in ways a caller would not expect from the manifest.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file introduces a broad credential-harvesting and fallback layer inside a skill advertised as IDW interpolation, which materially expands the trust boundary and attack surface beyond the stated purpose. Even without explicit exfiltration in this file, centralizing access to environment variables, ~/.netrc, and ~/.geoskill/secrets.json enables unrelated code paths in the skill ecosystem to retrieve sensitive credentials with no task-scoped restriction.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The module can read multiple classes of sensitive credentials from the user environment, home-directory files, and fallback defaults despite the surrounding skill context being a local interpolation tool. In a mismatched skill, this capability is especially risky because users and reviewers are less likely to expect credential access, making abuse or accidental overreach harder to detect.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring claims passwords are not cached, but load_user_secrets() copies secrets from secrets.json into the process-global _DEFAULTS dictionary and retains them for the lifetime of the process. This discrepancy can lead developers and users to make unsafe assumptions about in-memory secret exposure and increases the window in which other code in-process can access the loaded credentials.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file provides a generic remote download primitive with arbitrary URL support, local file write capability, resume/retry behavior, and batch download support, which exceeds the manifest's stated IDW interpolation purpose. Even if implemented with some safety features, this materially expands the skill's attack surface and can enable unintended network access, retrieval of untrusted data, and misuse as a staging mechanism inside a workflow that users would not expect to perform downloads.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A reusable downloader in an interpolation-focused skill is dangerous because it enables fetching arbitrary external content and writing it to disk without being justified by the declared functionality. In context, the mismatch between advertised purpose and embedded capability increases suspicion: users and reviewers may authorize an interpolation tool while unintentionally granting a network/file-ingestion component that could be abused for data exfiltration support, payload staging, or retrieval of malicious inputs.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file materially diverges from the declared skill purpose: instead of performing IDW interpolation and GeoTIFF generation, it implements place-name geocoding via external APIs. Such capability mismatch is dangerous because it expands the skill’s behavior beyond user expectations, introduces undeclared network/data-transfer behavior, and can be used to hide unrelated functionality inside a seemingly harmless geospatial package.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code sends user-supplied place queries to external services (Open-Meteo and Nominatim), which is not justified by the stated IDW interpolation functionality. Even if not overtly malicious, undeclared outbound requests create privacy and supply-chain risk by exfiltrating user input and making execution depend on third-party services.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation openly describes adapter behavior for place resolution, contradicting the package’s advertised interpolation purpose. This inconsistency is a security concern because misleading documentation and packaging reduce reviewer visibility and can conceal unexpected capabilities that process or transmit user data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-supplied place queries are sent to Open-Meteo and optionally Nominatim without any warning or consent flow in this file. Place names can contain sensitive operational or personal location information, so silent transmission to third parties creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module stores resolved place data under the user's home directory by default, without explicit notice or consent. Persistent local caching of location queries can expose sensitive geographic interests or workflows to other local users, backups, or forensic review.

Natural-Language Policy Violations

Medium

• Confidence: 70% confidence
• Finding: Forcing the Accept-Language header to zh-CN without user choice is primarily a privacy and policy issue rather than a direct exploit primitive. It can reveal assumptions about user locale, affect provider responses, and create unexpected behavior or compliance concerns for non-Chinese users.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes a fallback Earthdata username and password directly in source code. Hardcoded credentials are highly dangerous because anyone with repository or package access can reuse them, and downstream users may unknowingly authenticate with shared secrets that are difficult to rotate and may already be compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-provided place names are transmitted to external geocoding providers without any explicit warning or consent mechanism in this file. In skill contexts, such silent disclosure can leak sensitive locations, project names, or operational intent embedded in queries, especially when users expect only local interpolation processing.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 82% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 88% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15