geoskill-kriging-interpolation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:47 PM UTC
• Version: 1.0.0

Overview

The visible kriging tool is mostly local, but the package also ships unrelated network geocoding and credential-handling code that is not disclosed by the offline skill description.

Review before installing. Normal CLI kriging use appears local, but the package includes extra modules that can contact geocoding services, cache location lookups in the home directory, and read local credential stores for unrelated services. The publisher should remove or isolate those helpers, remove hardcoded credentials, fix vendored metadata, and clearly document any optional network or credential behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: the skill claims to be a local offline geostatistics tool, but the detected behavior includes online geocoding/weather services, caching, credential management, reading secrets from environment/.netrc/files, and even hardcoded default Earthdata credentials. Hidden network access and secret-handling capabilities materially expand the attack surface and can lead to credential exposure, unauthorized outbound requests, and user deception about privacy guarantees.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata claims this package is for the unrelated 'landsat-download' skill, which indicates a supply-chain integrity or packaging error. Even if accidental, this can cause the wrong core bundle to be trusted, complicate provenance verification, and hide substitution of code or metadata that does not match the advertised kriging-interpolation functionality.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This helper sends user-supplied place names to third-party geocoding services and writes results to a persistent cache under the user's home directory, which expands the skill's behavior beyond local interpolation. The main risk is unintended data disclosure and unexpected side effects on disk/network, especially if place queries are sensitive or the runtime assumes offline/local-only processing.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Network-based geocoding is not inherently unsafe, but in this skill context it is an unexpected capability that can exfiltrate user query data and introduce dependency on external services. Because the advertised purpose is kriging interpolation, hidden outbound lookups increase the attack surface and can violate operator expectations in restricted environments.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The documentation says antimeridian-crossing bounding boxes must be rejected unless specially handled, but the implementation only flags longitudes outside [-180, 180] and separately treats w >= e as a generic ordering error. A dateline-crossing bbox such as [170, -10, -170, 10] would not be explicitly recognized and may be mishandled by downstream area, clipping, or raster operations, leading to incorrect extents, silent data corruption, or denial-of-service from unexpectedly huge computations.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This interpolation skill ships a general-purpose credential manager that accesses multiple unrelated services, which materially expands the capability surface beyond the declared kriging-only purpose. In a narrow geospatial interpolation context, bundled support for harvesting credentials from environment variables, user secrets files, and .netrc increases the risk of unnecessary secret exposure and abuse if any downstream code imports or uses these helpers.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The module provides accessors for OpenAI, FIRMS, CMA, Earthdata, and EOG credentials even though the stated skill purpose is semivariogram fitting, ordinary kriging, cross-validation, and GeoTIFF output. This mismatch is suspicious because it creates latent access to unrelated external accounts and APIs without a clear functional justification, increasing the blast radius if the skill or its dependencies are compromised.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation asserts that passwords are not hardcoded in skill source, yet this file contains real-looking fallback Earthdata credentials in code. Hardcoded credentials are dangerous because they can expose a real account immediately to anyone with source access and can also mislead users and reviewers into trusting a false security claim.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), creating an external data disclosure path that is not clearly implied by the interpolation-focused skill description. In a skill context, undocumented outbound requests can expose sensitive user inputs, operational locations, or proprietary project names to external services and may violate least-privilege or privacy expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Geocoding queries are transmitted to external services without any user-facing notice in this file, so place names may be disclosed to Open-Meteo and Nominatim unexpectedly. In data-processing pipelines, location strings can be sensitive operational metadata, making silent transmission a real privacy and compliance risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The fallback defaults include a plausible username and password pair, which is direct secret exposure even if described as a fallback. Such credentials can be reused by attackers, accidentally propagated into logs or forks, and normalize insecure secret-management practices inside a package that users may trust.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 85% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 83% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 82% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 85% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15