geoskill-lake-area-change

• Outcome: Review
• Latest audit: Aug 4, 2026 · 12:46 PM UTC
• Version: 1.0.0

Overview

The main lake-analysis script is local and purpose-aligned, but the package also contains under-disclosed credential, geocoding, downloader, and persistent-cache code that does not fit the published skill description.

Install only after reviewing or removing the bundled credential and network helper modules, replacing the hardcoded Earthdata fallback, documenting any geocoding/network use, and pinning dependencies. Treat location queries and local credential files as sensitive if this package is used beyond the documented synthetic/local raster workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation declares no permissions, yet the analyzed capability set includes environment access, file read/write, shell, and network. That mismatch is dangerous because users and orchestrators may authorize or run the skill under false assumptions, enabling unintended access to local secrets, filesystem contents, or remote endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a significant description-behavior mismatch: a lake-area analysis skill reportedly also handles hardcoded/default credentials, reads secrets from env/.netrc/local secret files, performs online geocoding, and includes a general-purpose downloader and metadata registry unrelated to the stated task. In context, hidden credential harvesting or broad external-access logic is especially risky because a narrowly described geospatial skill would not reasonably be expected to touch unrelated secrets or support generic network operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored core metadata claims this package is for the skill 'landsat-download' while the surrounding skill is 'geoskill-lake-area-change'. This mismatch is a real supply-chain integrity issue because it can indicate the wrong vendored dependency set was copied in, provenance tracking is broken, or a different skill's trusted core is being represented as part of this one. In a security review context, inconsistent identity metadata reduces trust in the package contents and can hide accidental or deliberate substitution of code.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The module persistently stores user-supplied place queries under the user’s home directory by default, which can expose sensitive location interests to other local users, backup systems, or forensic collection. Although not a remote exploit, silent persistence of location data is a real privacy weakness because users may not expect geocoding inputs to be retained on disk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill makes outbound HTTP requests to third-party geocoding services, which exposes user-supplied place names and associated metadata to external providers. Even if intended for legitimate AOI resolution, this creates privacy, compliance, and availability risk because requests are sent off-platform without clear consent or manifest disclosure.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: User-supplied place names are transmitted to external geocoding services without any in-code disclosure or confirmation, which can leak sensitive geographic intent or operational context to third parties. In a geospatial analysis skill, location inputs may themselves be sensitive, so silent network transmission creates a meaningful privacy and data-handling risk.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: Resolved place queries and manifests are written to persistent cache files without user-facing disclosure, which can leave a durable local record of sensitive locations. This is dangerous primarily as a privacy issue because it increases exposure through shared hosts, backups, and unintended data retention.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module embeds a real-looking fallback username and password directly in source code. Hardcoded credentials are dangerous because anyone with code access can reuse them, and the skill will silently authenticate with them when environment or user secrets are absent, creating unauthorized access risk and secret sprawl.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15