geoskill-insurance-risk-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:42 PM UTC
• Version: 1.0.0

Overview

The main risk-mapping tool appears local, but the package includes undisclosed helper code for credentials, external network lookups/downloads, and persistent location caching.

Review before installing. The advertised CLI can be used as a local raster loss calculator, but the package also ships broader geospatial helper modules that are not described in the skill page. Avoid invoking the place-resolution or credential helper modules unless you accept third-party geocoding, local secret reads, and persistent AOI caching; the publisher should remove hardcoded credentials, document network and cache behavior, and pin dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation declares an offline/local geospatial analysis workflow, yet the detected capabilities include shell, environment access, file read/write, and network without any declared permissions or user-facing disclosure. This creates a transparency and trust problem: an operator may execute the skill assuming limited local processing while the implementation can access local secrets, modify files, or make outbound connections.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: the skill claims to perform insurance loss mapping, but the analyzed behavior includes geocoding, remote downloads, credential handling for multiple third-party services, reading local secrets/.netrc, and even embedded default credentials. That combination materially expands the attack surface and can lead to credential theft, unintended data exfiltration, and execution of networked behaviors the user did not consent to.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata declares a separate skill, "landsat-download," inside an insurance risk mapping skill, creating a clear capability and purpose mismatch. Even without code execution in this file, unexpected embedded components increase supply-chain risk because downstream users may inherit downloading behavior, hidden dependencies, or functionality not reviewed against the advertised purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The metadata references files such as safe_download.py and credentials.py, indicating network retrieval and credential-handling capabilities that are not obviously necessary for insurance loss modeling as described. In a mismatched skill context, these capabilities are more dangerous because they can enable data exfiltration, unauthorized external access, or secret misuse under the cover of unrelated business logic.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The code stores persistent cache files under the user's home directory without requiring explicit opt-in, which can retain sensitive location queries and resolved AOI data beyond the current session. In an insurance risk mapping context, place names and bounding boxes may reveal business-sensitive or personal location interests, so silent persistence creates a real confidentiality risk on shared systems or developer workstations.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module claims passwords are not cached, but `load_user_secrets()` persists secrets in the `_DEFAULTS` dictionary for the lifetime of the process. This discrepancy can mislead users and reviewers, causing underestimation of in-memory secret exposure in long-lived processes or debugging scenarios.

Context-Inappropriate Capability

Medium

• Confidence: 73% confidence
• Finding: The file makes outbound requests to third-party geocoding services using raw user-provided place names, creating an external data-sharing path that is not obviously minimized or user-consented. In an insurance context, queried locations may reveal sensitive operational, customer, or asset information, so unnecessary or undocumented network resolution increases privacy and supply-chain exposure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User-supplied place queries are transmitted to third-party geocoding services without any explicit user-facing notice or consent mechanism in this code path. Those queries can contain sensitive operational or personal location information, and in an insurance risk mapping skill that sensitivity is elevated because locations may correspond to insured assets, client sites, or underwriting targets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function writes resolved location data to a persistent local cache with no warning or consent, creating a privacy and data-retention risk. In this skill's context, cached AOI manifests may expose sensitive asset locations or analysis targets to other local users, backup systems, or later unintended processing.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete username and password. Hardcoded secrets are highly dangerous because anyone with source access can reuse them, and downstream consumers may unknowingly authenticate with shared credentials, enabling account compromise, abuse attribution issues, and secret leakage into forks or packages.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: Hard-coding the Accept-Language header to Chinese sends locale/preferences information to a third-party service regardless of user intent and may also bias results unexpectedly. While not severe on its own, it is an unnecessary privacy leak and can create integrity issues in geocoding outcomes for non-Chinese users or datasets.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15