Security audit

geoskill-irrigation-scheduling

Security checks across malware telemetry and agentic risk

Overview

The main irrigation tool looks local, but the package includes under-disclosed credential, geocoding, caching, and download helpers that should be reviewed before installation.

Install only after reviewing or removing the vendored core pieces that are not needed by the irrigation scheduler, especially the credential module with embedded Earthdata credentials, the geocoding/cache helper, and the generic downloader. Ask the publisher to document all network and credential behavior, correct the vendored metadata, and pin dependencies before using this in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation declares no permissions, yet the associated capability profile indicates access to environment variables, local files, network, and shell execution. This creates a transparency and trust problem: users may run an apparently simple offline irrigation tool without understanding that it can read secrets, write files, invoke commands, or contact external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose is narrowly about irrigation scheduling, but the analyzed behavior includes geocoding, generic download infrastructure, credential handling for multiple external services, and even hardcoded fallback credentials. That mismatch is dangerous because it can conceal broader data access and outbound connectivity than users expect, and hardcoded credentials materially raise the risk of unauthorized access or secret misuse.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the declared irrigation scheduling skill. This indicates a supply-chain integrity or packaging mismatch: consumers and tooling may validate, trust, or load artifacts under the wrong identity, increasing the risk of shipping unintended code or bypassing provenance checks.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The AOI helper sends user-supplied place names to third-party geocoding services and stores results in a local cache under the user's home directory, which extends behavior beyond pure irrigation scheduling logic. This creates a real privacy and data-handling risk because sensitive locations may be disclosed externally and persisted locally without any visible consent, opt-in, or clear boundary in this module.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The module claims credentials should not be hardcoded, yet it embeds fallback secrets in source. Hardcoded credentials can be harvested from the repository or package and abused anywhere those credentials are valid, especially because this is a shared credential manager likely reused across skills.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This skill vendors a reusable network downloader with retry, resume, and arbitrary file-write behavior that is broader than what an irrigation scheduling skill should need. Even if not overtly malicious, the capability increases attack surface by enabling remote content retrieval and persistence to disk, which can be misused by other parts of the skill or future changes to fetch untrusted payloads.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The code performs arbitrary HTTP retrieval and writes the response to a caller-controlled local path, which exceeds the stated irrigation-scheduling purpose. In this context, hidden network and filesystem capabilities are dangerous because they can exfiltrate metadata, import untrusted data into the environment, or overwrite application files if an attacker can influence URLs or destination paths.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The markdown states that the skill produces local output files but does not clearly warn users that execution will write to disk. While not a direct exploit by itself, this omission can lead to unsafe assumptions in sensitive environments where local writes may overwrite data, consume storage, or violate operational constraints.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The data-source section is incomplete and does not disclose whether non-synthetic runs may use local or remote real-world datasets. This weak disclosure can mislead users about privacy, network usage, provenance, and compliance implications, especially because other findings indicate broader network and credential capabilities.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code transmits raw user-provided location queries to external services without any in-code disclosure, consent mechanism, or minimization. In an irrigation context, place names can reveal farm, field, or business locations, so silent external transmission meaningfully increases privacy and operational sensitivity risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The file contains a real-looking fallback username and password, making accidental live credential exposure likely. Because the credential manager auto-resolves defaults when env vars and files are absent, downstream code may silently authenticate with exposed shared credentials, masking misuse and increasing blast radius.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: The Nominatim request unconditionally sets Accept-Language to zh-CN,zh;q=0.9, which can override user expectations and leak a misleading locale preference to a third-party service without consent. This is mainly a privacy and policy issue rather than a direct compromise vector, but it can affect returned data and create unnecessary user profiling signals.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 97% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 96% confidence
Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 82% confidence
Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15