geoskill-informal-settlement-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:40 PM UTC
• Version: 1.0.0

Overview

The skill mostly performs local geospatial scoring, but it also bundles undisclosed network and credential-handling code with embedded credentials, so it should be reviewed before installation.

Install only if you are comfortable with reviewing or removing the bundled helper modules that handle network geocoding, downloads, local credential stores, and hardcoded Earthdata defaults. Treat the classification output as a rough analytical signal requiring human review, not as a basis for enforcement or decisions affecting communities.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill advertises only an offline geospatial classification workflow, but the analysis indicates capabilities for shell, file I/O, environment access, and network use without any declared permissions. Undeclared powerful capabilities undermine user trust and can enable unexpected data access or exfiltration if the implementation invokes them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims local informal-settlement detection, yet static analysis reports geocoding, remote downloads, credential handling, and even hardcoded fallback credentials. Hidden network access and embedded credentials materially increase the risk of unauthorized access, secret leakage, remote data retrieval, and behavior the user did not consent to.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring claims ambiguity is handled without silently taking the first candidate, but the implementation sorts candidates and automatically selects the top result, and Nominatim fallback also takes the first match. This can cause analysis to run on the wrong geographic area without user awareness, which is especially risky in geospatial workflows where AOI accuracy determines downstream decisions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file hardcodes fallback Earthdata credentials directly in source code, creating embedded access that any recipient of the code can reuse. In a geospatial skill, this is especially dangerous because the module is explicitly designed to retrieve and use credentials automatically, so the exposed account can be abused for unauthorized data access and the practice encourages secret sprawl.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill classifies areas as 'informal settlements'/'shantytowns,' which is a sensitive socioeconomic inference that could stigmatize communities or be misused in enforcement, displacement, or discriminatory decision-making. The absence of a user warning, limitations statement, or guidance on appropriate use increases the risk of harmful downstream use even if the code is technically local.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: User-supplied place names are transmitted to third-party geocoding services without any explicit warning or consent mechanism in this file. While not enabling code execution or privilege escalation, it can leak sensitive operational context such as target locations, project interests, or user activity to external providers.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded fallback credentials are active code behavior, not just example text, and there is no runtime safeguard preventing their use in production. This means deployments may silently authenticate with a shared embedded account, making compromise, misuse attribution, and secret leakage much more likely.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN/zh without user choice, which can override user expectations and influence returned place names or jurisdictional interpretations. While not typically a direct compromise vector, forcing locale can cause incorrect geocoding results, privacy surprises, and downstream misclassification if the AOI is resolved differently than the user intended.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15