geoskill-image-fusion-pan-sharpening

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:34 PM UTC
• Version: 1.0.0

Overview

The advertised pan-sharpening tool is mostly local, but the package also ships under-disclosed geocoding, credential, and cache code unrelated to the stated task.

Review carefully before installing. The documented entrypoint appears suitable for local pan-sharpening, but the package should remove or clearly gate the unrelated geocoding, credential, cache, and download helpers, remove the hardcoded credential, correct vendored provenance metadata, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises offline/local processing and does not declare permissions, yet the detected capabilities include file read/write, shell, environment access, and network. This mismatch is dangerous because users and orchestrators may grant or assume a lower trust level than the implementation actually requires, enabling unintended access to local data or command execution if the underlying script is invoked.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored metadata claims this package contains code for a different skill ('landsat-download') than the advertised pan-sharpening skill, which indicates a supply-chain integrity and provenance mismatch. Even if accidental, this can cause reviewers and automation to validate the wrong dependency set, increasing the risk of hidden or substituted code being shipped without proper scrutiny.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file adds geocoding over the network plus local cache persistence, which materially expands the skill’s capabilities beyond the declared pan-sharpening/image-fusion purpose. That creates unnecessary data egress of user-supplied locations to third parties and persistent local state in the user home directory, increasing privacy and supply-chain risk if invoked implicitly by the skill.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The code introduces outbound HTTP requests to Open-Meteo and Nominatim even though the skill is described as pan-sharpening image fusion, not geocoding. Unnecessary external connectivity is dangerous because it can leak sensitive place queries, create hidden dependencies on third-party services, and violate least-privilege expectations for users running an offline/local image-processing workflow.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code writes persistent cache files under the user’s home directory for place-resolution results, which is not obviously required for image-fusion processing. Persistent writes can leave behind sensitive location history, surprise users expecting stateless processing, and create unintended cross-run data retention.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module centralizes access to multiple unrelated external-service credentials inside a skill whose stated purpose is pan-sharpening imagery. Broad credential capability increases blast radius: any code path in the skill can retrieve sensitive credentials for unrelated services, enabling unauthorized access or data exfiltration if the skill or a dependent component is compromised.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: Including OpenAI API key access in an image pan-sharpening skill is unjustified by the declared functionality and creates a path for unrelated outbound use of a powerful external API credential. In this context, unnecessary access to LLM credentials materially raises the risk of covert data transfer, prompt relaying, or billing abuse.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill exposes credential access for FIRMS, CMA, and EOG services that do not align with the manifest’s narrow pan-sharpening purpose. Even without direct exfiltration code here, unnecessary credential reach expands attack surface and violates least-privilege design.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The module claims passwords are not hardcoded in skill source, yet _DEFAULTS contains a concrete Earthdata username and password. Hardcoded credentials in source are a severe secret-management failure: they can be copied from the repository, reused by anyone with code access, and often persist long after intended use.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The exported resolve_place() API introduces place-name resolution and potential network-backed AOI lookup in a skill whose declared purpose is pan-sharpening image fusion. That mismatch increases attack surface and data-flow beyond user expectations, because user-supplied place strings may be sent to external resolvers through _geoskill_core without any indication in this file that geocoding is essential to the skill’s function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The legacy fallback preserves full external geocoding behavior, including requests to Open-Meteo and Nominatim, even though this capability is unrelated to Brovey/IHS pan-sharpening. Hidden fallback networking is risky because it can quietly exfiltrate user-provided place names and keep undeclared functionality alive even if the primary core path changes or fails.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs network geocoding against third-party services based on arbitrary user input, which is not justified by the stated image-fusion purpose. Unnecessary network capability expands privacy and supply-chain risk, and creates opportunities for misuse as a generic geocoding proxy inside a skill users would not expect to contact outside services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User-provided place names are transmitted to third-party geocoding services without any in-code disclosure, consent mechanism, or obvious user-facing warning. In a geospatial workflow, place queries may reveal sensitive operational areas, so silent transmission is a meaningful privacy and security concern.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided place queries are transmitted directly to external geocoding endpoints, which can reveal sensitive locations or project context without clear disclosure in this file. Because the skill is presented as an image-fusion tool rather than a geocoding tool, users are less likely to anticipate this data sharing, making the privacy issue more significant.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Forcing the Accept-Language header to zh-CN/zh without user choice or clear justification can influence returned results and leaks an implicit locale preference to the external service. While not critical on its own, it is an unnecessary privacy and transparency issue, especially in a skill unrelated to locale-sensitive geocoding.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15