geoskill-impervious-surface-trend

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:40 PM UTC
• Version: 1.0.0

Overview

The main tool appears to do local raster analysis, but the package also includes undeclared credential-handling and network helper code with an embedded account credential, so it should be reviewed before installation.

Install only after reviewing or removing the vendored credential, geocoding, and download helpers. At minimum, remove the embedded Earthdata credential, document any network geocoding and cache behavior, and pin dependencies before using this in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a serious mismatch: the skill claims to do local impervious-surface trend analysis, but the reported behavior includes online geocoding, credential discovery from ~/.netrc and ~/.geoskill/secrets.json, returning external-service credentials, and even hardcoded Earthdata credentials. Hidden credential access and unrelated network/download features materially expand the attack surface and could enable secret exfiltration or unauthorized use of third-party services under the guise of a benign geospatial workflow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored core declares a different skill identity ('landsat-download') than the advertised purpose of impervious-surface trend analysis, which is a supply-chain and functionality-mismatch risk. This discrepancy can hide undeclared capabilities, expand the attack surface, and make reviewers trust a package whose bundled behavior is not aligned with the stated use case.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Including credential-handling and download-oriented modules in a skill described only as trend analysis introduces unnecessary privileged functionality. If these modules are reachable, they could enable unexpected network access, data exfiltration, or misuse of stored credentials, and even if unused they increase review difficulty and attack surface.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This AOI helper goes beyond pure local trend-analysis logic by performing external geocoding and persisting query results to local disk. That expands the skill's trust boundary and creates privacy and data-flow risks because user-supplied place names may be transmitted to third parties and stored under the user's home directory without clear consent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends location queries to Open-Meteo and Nominatim, which is a real security/privacy concern when the advertised capability is impervious-surface trend analysis rather than third-party data sharing. Even if the behavior is functionally useful for AOI selection, it exposes user inputs and metadata to external services and introduces dependency on remote endpoints.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This module provides broad credential brokerage for multiple external services that are not justified by the stated purpose of an impervious-surface trend analysis skill. In this context, expanding the secret-access surface increases the chance the skill can access or later exfiltrate unrelated credentials, which is a real least-privilege violation even though this file itself does not transmit them.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module manages credentials for FIRMS, CMA, and EOG despite no clear connection to impervious-surface trend analysis. Unused cross-service secret access is dangerous because any later code path in the skill can reuse this helper to reach unrelated services without additional review.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module manages credentials for FIRMS, CMA, and EOG despite no clear connection to impervious-surface trend analysis. Unused cross-service secret access is dangerous because any later code path in the skill can reuse this helper to reach unrelated services without additional review.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The docstring says passwords are not hardcoded, yet the module embeds a default Earthdata username and password in source. Hardcoded credentials are a direct secret exposure risk: anyone with source access can reuse them, and downstream users may unknowingly authenticate as the embedded account.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The documentation claims passwords are not cached, but user secrets are loaded into the in-memory _DEFAULTS structure and guarded by a loaded flag. This discrepancy can mislead reviewers and operators about secret lifetime, increasing the risk of improper handling in long-lived processes or debugging scenarios.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The file exposes place-name resolution and AOI lookup behavior that is broader than the manifest’s stated purpose of impervious-surface trend fitting and hotspot detection. This capability can send user-supplied locations to external resolvers and expand the skill’s data-handling surface without clear justification, increasing privacy and surprise-risk even if the code is not overtly malicious.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code performs network requests to third-party geocoding services (Open-Meteo and Nominatim) using user-provided place names. In a skill described as impervious-surface trend analysis, this undisclosed external transmission is dangerous because it leaks user queries and operational metadata to outside services, creates dependency on untrusted remote responses, and expands the attack surface beyond the stated function.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Geocoding queries are transmitted to external services without any user-facing disclosure in this code path. That is dangerous because place names can be sensitive operational context, and silent transmission can violate user expectations, privacy requirements, or organizational data-handling policies.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The helper writes resolved queries to a cache file in the user's home directory, which can persist potentially sensitive place names and AOI details beyond the current session. Undisclosed local persistence increases privacy and multi-user workstation risk, especially if filesystem permissions, backup tooling, or later processes expose the cache contents.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Hardcoded fallback credentials are present and there is no warning to users when they are used. This is dangerous because the skill may silently authenticate with embedded credentials, masking unsafe defaults and potentially exposing a shared account to abuse, quota exhaustion, or attribution problems.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The Nominatim request forces the Accept-Language header to Chinese without user choice. While not a code-execution flaw, it can cause unexpected data handling and localization behavior, reveal assumptions about the user or deployment context, and produce misleading or biased results that the user did not request.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15