geoskill-interactive-webgis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:43 PM UTC
• Version: 1.0.0

Overview

The main WebGIS tool is mostly local, but the package ships under-disclosed credential, network, download, and persistent-cache helpers that do not fit the advertised self-contained offline purpose.

Install only after reviewing whether you want this skill package to include broad geospatial-core helpers. For normal local WebGIS generation, the main script appears scoped to local inputs and outputs, but the package should remove or clearly disclose the credential helpers, hardcoded Earthdata credentials, remote geocoding, home-directory cache, and browser-time external map/CDN access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill metadata declares an offline, self-contained WebGIS generator, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. This mismatch reduces transparency and can enable unexpected data access, command execution, or outbound communication in environments that rely on the manifest to make trust decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: the skill presents itself as a local, offline HTML WebGIS generator, but analysis indicates external service interaction, credential handling, hardcoded fallback credentials, downloading, and persistent cache storage under the user's home directory. Hidden network activity and embedded credentials materially increase the risk of data exfiltration, unauthorized remote access, supply-chain exposure, and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored dependency manifest claims the bundled code belongs to the skill 'landsat-download' while this package is described as a WebGIS skill, indicating a supply-chain integrity mismatch. Even though this file is only metadata, such inconsistencies can hide accidental code reuse, packaging mistakes, or substitution of code from an unrelated skill, undermining trust in what was actually shipped and reviewed.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module sends user-supplied place names to external geocoding services, which breaks the stated offline/self-contained expectation and can leak potentially sensitive location queries to third parties. In a WebGIS helper, location inputs may reveal user interests, assets, or operational areas, so undisclosed outbound requests are a real security/privacy concern even if the implementation is not overtly malicious.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The code persists query-derived AOI manifests under the user's home directory, creating undeclared local state and retaining potentially sensitive place searches beyond the current run. While this is not code execution or privilege escalation, it is still a privacy and data-handling issue because users of a 'self-contained' app would not expect silent filesystem writes.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module is far broader than a lightweight self-contained WebGIS configurator: it centralizes retrieval of multiple third-party credentials, including Earthdata, FIRMS, CMA, EOG, and OpenAI. In this skill context, that expanded credential surface is dangerous because it enables the skill to access sensitive user secrets and external services unrelated to the stated purpose, increasing the blast radius if the skill is abused or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Support for OPENAI_API_KEY is not justified by the declared purpose of configuring a lightweight HTML WebGIS app. Unnecessary support for additional API credentials widens access to sensitive secrets and creates opportunities for unauthorized use of paid APIs or cross-service pivoting.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module reads secrets from the user's home directory and .netrc, which exceeds expectations for a self-contained HTML app configurator. In this context, automatically discovering local secrets is risky because it silently expands the skill's privilege to data the user did not explicitly provide to this app.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation states that passwords are not cached, but load_user_secrets copies secret values into the module-level _DEFAULTS dictionary and retains them for the process lifetime. This mismatch can mislead reviewers and operators into underestimating memory residency of credentials, increasing accidental exposure risk in long-lived processes, dumps, or debugging tools.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill advertises offline/self-contained generation, but the generated HTML pulls Leaflet from unpkg.com and map tiles from tile.openstreetmap.org at runtime. This creates a privacy and supply-chain risk: opening the output causes unexpected network access that can leak user IP/location context and makes the artifact non-functional or externally dependent in offline or restricted environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Location queries are transmitted to Open-Meteo and Nominatim without any visible user-facing disclosure or consent mechanism. Because geographic searches can be sensitive, undisclosed sharing with third-party services creates a real privacy exposure, especially given the skill's advertised lightweight/self-contained context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The module stores resolved queries and AOI data persistently in the user's home directory without any user-facing disclosure. This can expose sensitive search history to other local users, backup systems, or later forensic inspection, making it a genuine privacy issue rather than a mere implementation detail.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The code hardcodes fallback Earthdata credentials directly in source: a username and password are embedded in _DEFAULTS. Hardcoded live credentials are a severe secret-management failure because anyone with code access can reuse them, and the skill can silently authenticate to external services without explicit user consent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can expose sensitive location queries to external providers without any in-file consent, warning, or privacy guardrails. In a WebGIS skill, place names may reveal private interests, home/work locations, or operationally sensitive sites, so silent transmission creates a real privacy risk even though it is expected functionality.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN/zh, overriding user locale and potentially disclosing inferred language or regional assumptions to the remote service. This is primarily a privacy and policy issue rather than code-execution risk, but it can affect user expectations, returned data, and auditability when locale should be user-controlled.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 92% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 92% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 98% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 98% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 95% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15