geoskill-image-registration

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:38 PM UTC
• Version: 1.0.0

Overview

The main image-registration script is local, but the package also includes undisclosed geocoding, downloading, caching, and credential-reading code that does not fit the stated purpose.

Review this before installing in any environment with real credentials or sensitive geospatial work. The image-registration entrypoint appears local, but the package should be split or trimmed so downloader, geocoding, caching, and credential helpers are removed or explicitly documented and opt-in. Run only in an isolated environment with network access disabled and without valuable .netrc, environment secrets, or ~/.geoskill/secrets.json present unless you intentionally need those extra modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (39)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its documented and inferred capabilities include network, shell, filesystem access, and environment/secrets reading. This creates a trust-boundary violation: users may invoke what appears to be a local image-registration skill while it can access local data, credentials, and external services without explicit disclosure or permission gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is narrow offline FFT-based image registration, but the analyzed behavior includes geocoding, network access, credential discovery from environment/.netrc/secrets files, download management, and even built-in Earthdata credential fallback. This mismatch is dangerous because it hides sensitive behaviors behind an innocuous description, increasing the chance of unnoticed credential exposure, unintended outbound requests, and over-privileged execution.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata shows this skill bundles a different component, `landsat-download`, including files for downloads, AOI handling, sensor logic, checks, and credentials, which does not align with the stated FFT image-registration purpose. This kind of capability mismatch is dangerous because it expands the skill’s effective trust boundary and can introduce hidden network access, credential handling, or data exfiltration paths that users would not expect from an offline registration utility.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Including download and credential-management modules inside a skill whose described function is image registration represents unnecessary privileged functionality. Even if not actively malicious, these extra capabilities increase attack surface and create opportunities for unauthorized outbound access, misuse of user credentials, or future abuse through dormant code paths.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file adds AOI geocoding, network access, and persistent caching capabilities that are unrelated to the stated FFT-based image registration purpose. Capability mismatch is dangerous because it expands the skill’s data-access and exfiltration surface without clear user expectation, making hidden collection of location queries and environment-derived state more plausible.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code sends user-supplied place queries to third-party services (Open-Meteo and Nominatim), disclosing potentially sensitive geographic intent to external providers. In the context of an image-registration skill, this is unexpected network behavior and increases privacy, supply-chain, and policy-bypass risk because operation depends on outside services not implied by the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module persists geocoding results under the user's home directory, creating a durable record of location queries outside the skill’s core image-registration purpose. Even if the cached data is not highly secret by itself, persistent storage of geographic lookups can leak sensitive project context, user interests, or operational locations to other local users or later processes.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The docstring states these checks are mandatory and should be enforced before writing outputs, but the implementation largely returns warning lists and leaves enforcement to callers. In a data-processing pipeline, this can create a false sense of safety: downstream code may assume scientific validation is guaranteed when invalid CRS, bbox, nodata, or unit metadata can still pass through and contaminate results.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file belongs to an image-registration skill, but it implements a broad credential broker for multiple unrelated external services, expanding the privilege and attack surface far beyond the declared purpose. In a skill ecosystem, this makes the component capable of harvesting or exposing credentials that users would not reasonably expect to be touched by an image-registration feature.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code hardcodes fallback credentials, including a plaintext Earthdata username and password, inside source. Hardcoded secrets are immediately recoverable by anyone with repository or package access and can enable unauthorized use of the external account; in this skill context, it is especially suspicious because the advertised functionality does not require embedding broad service credentials at all.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring states passwords are not cached, but `load_user_secrets()` copies secrets into the process-wide `_DEFAULTS` dictionary and retains them for the process lifetime. Misrepresenting secret-handling semantics increases the chance that downstream code, operators, or auditors treat the component as lower risk than it actually is, while secrets remain resident in memory longer than promised.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file introduces a reusable network downloader into a skill whose declared purpose is local image registration via FFT-based translation estimation. Even though the implementation includes safety features like atomic writes and optional hash checks, it still expands the skill’s capability surface to fetch arbitrary remote content, which is unnecessary for the stated scope and can enable unreviewed data ingress or supply-chain abuse when invoked by other components.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This code provides a general-purpose remote download primitive that accepts arbitrary URLs and writes attacker-controlled content to local paths, with batching support. In the context of an image-registration skill, that capability is broader than necessary and increases risk of SSRF-like access to internal resources, retrieval of malicious payloads or oversized files, and abuse by downstream code if URL and filename inputs are not tightly controlled; optional SHA256 validation does not mitigate cases where callers omit it.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The exported resolve_place() API introduces external place-resolution behavior that is unrelated to the declared image-registration purpose of the skill. In an agent context, this expands capability scope and can cause unanticipated outbound network access, data disclosure of user-supplied locations/queries, and misuse of the skill as a geocoding primitive rather than image alignment logic.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The legacy implementation performs live HTTP requests to Open-Meteo and Nominatim, giving the skill undisclosed outbound network capability. Because the skill is supposed to do local image registration, these requests are unjustified and dangerous: user inputs or derived data can be exfiltrated to third parties, behavior becomes non-deterministic, and the module can be repurposed to reach external services from restricted workflows.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module header explicitly states that this file is an adapter for AOI/place resolution, which conflicts with the manifest description of subpixel image registration. This capability mismatch is a security concern because it conceals non-obvious functionality from reviewers and users, increasing the chance that privileged workflows invoke unexpected code paths with external side effects.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 79% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 79% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 79% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 74% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 78% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 78% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 78% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 92% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 92% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15