geoskill-insar-deformation-monitoring

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:41 PM UTC
• Version: 1.0.0

Overview

The main InSAR tool appears to run locally, but the package also ships under-disclosed credential, network geocoding, download, and cache code, including hardcoded Earthdata fallback credentials.

Review before installing. The core InSAR script is local, but the package includes extra network and credential modules that are not clearly documented; do not install it in an environment with sensitive .netrc, ~/.geoskill/secrets.json, or environment secrets unless those modules are removed or the publisher narrows and discloses them. The embedded Earthdata credentials should be removed and rotated by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises only local/offline InSAR processing, but the detected capabilities include shell, file access, environment access, and network without any declared permissions or user-visible disclosure. This is dangerous because users and policy enforcement layers cannot accurately assess or constrain what the skill may do, increasing the risk of unintended data access, command execution, or outbound connections.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is simplified D-InSAR processing, but the detected behavior includes unrelated network geocoding, generic HTTP download logic, centralized credential handling, and especially embedded fallback Earthdata credentials. This mismatch is dangerous because it hides materially broader behavior than users expect and introduces credential exposure and unauthorized remote access risks well outside the stated scope of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored core metadata claims the bundled code is for the 'landsat-download' skill, while this package presents itself as an InSAR deformation-monitoring skill. This mismatch undermines supply-chain integrity and provenance verification because reviewers and tooling can no longer trust that the vendored core corresponds to the declared skill purpose. In a geospatial processing skill, this is more concerning because users may rely on the vendored core for file handling, downloads, credential use, or other privileged operations that are not obviously related to InSAR.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The AOI resolver performs outbound HTTP requests to Open-Meteo and Nominatim, which expands the skill from local SAR processing into networked geocoding. That creates a privacy and data-flow risk because user-supplied place names are sent to third parties, and it increases attack surface and operational dependency beyond what the skill description suggests.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The code defines a persistent cache directory under the user's home folder and later stores resolved AOI manifests there. This is a data persistence behavior not apparent from the skill description and can leave location history on disk, which is a confidentiality and transparency issue on shared or sensitive systems.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The external geocoding capability is not necessary for core D-InSAR deformation computation and introduces network exfiltration of user queries plus reliance on third-party services. In this skill context, that mismatch matters because users reasonably expect local processing of SAR inputs, not hidden geocoding traffic.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: This credentials module is far broader than the stated D-InSAR skill scope: it handles OpenAI, CMA, FIRMS, and EOG secrets in addition to Earthdata. That unnecessary breadth increases the attack surface and enables unrelated secret discovery/use if other parts of the skill or future changes call these helpers, though by itself it is more of an overprivilege/design issue than an immediate exploit primitive.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded, yet the module embeds a real-looking fallback Earthdata username and password. Hardcoded credentials in source control can be extracted by anyone with code access, reused unintentionally in production, and may expose third-party accounts or normalize insecure secret-handling patterns.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code performs arbitrary outbound HTTP(S) fetches from a caller-controlled URL with no domain allowlist, scheme restriction, or local-address filtering. In an agent environment, this can enable SSRF-style access to internal services, unauthorized egress to attacker infrastructure, or retrieval of untrusted content unrelated to the stated SLC-processing purpose, making the skill context more concerning because the manifest describes processing provided inputs rather than general network fetching.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file adds broad place-name geocoding and network AOI resolution behavior that is not clearly required by the declared D-InSAR processing purpose, which increases attack surface and data egress beyond the skill's stated scope. Even if not overtly malicious, hidden or unnecessary capability expansion is dangerous in agent skills because user inputs may be sent to third-party services and the agent gains functionality users did not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code issues external HTTP requests to Open-Meteo and Nominatim using user-supplied place names, creating an undeclared data flow to third parties. In the context of an InSAR deformation-processing skill, this is risky because user AOI queries may reveal sensitive locations or operations, and the network dependency is not justified by the stated file-processing scope alone.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Place queries are transmitted to external geocoding services without any visible warning, consent flow, or disclosure in this code. That is dangerous because place names may reveal sensitive operational areas, project sites, or user interests, and users are not given a chance to prevent that disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Resolved location data is written to a persistent cache in the user's home directory without notice or consent. This can expose AOI history to other local users, backups, or forensic review, which is particularly sensitive for geospatial workflows involving infrastructure or monitoring targets.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The fallback defaults include a plausible live username/password and are silently used if the environment is unset. That creates a hidden authentication path that may cause the skill to operate under someone else's account, leak account activity, and expose the credentials to anyone inspecting the repository or package.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: User-provided place queries are transmitted to external geocoding services without any visible disclosure or consent mechanism in this file. While common in geocoding code, it is still a privacy issue because users may assume an image-processing skill operates locally and does not export potentially sensitive location strings.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 95% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15