Security audit

geoskill-land-value-estimation

Security checks across malware telemetry and agentic risk

Overview

The advertised land-value tool is mostly local, but it ships unrelated network, downloader, cache, and credential-handling code that is not disclosed by the skill description.

Review this package before installing. The core land-value script appears to run locally, but the artifact also ships broad reusable helpers that can read local credential stores, use embedded fallback credentials, make outbound geocoding/download requests, and write cache files. Install only if you are comfortable with that extra code being present, and avoid providing secrets to this environment unless the package is cleaned up or sandboxed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no permissions, yet the associated capability profile indicates access to environment variables, filesystem, shell, and network. That mismatch is dangerous because users and orchestrators may treat the skill as local/offline and low-risk while it can read sensitive data, invoke commands, and exfiltrate information.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is a simple offline land-value model, but the detected behavior includes unrelated geocoding, remote downloads, multiple credential-management paths, and even hardcoded fallback credentials. This is highly suspicious because it broadens the attack surface far beyond the stated function and creates clear opportunities for secret misuse, covert data access, and unnoticed outbound communications.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The vendored core metadata claims the embedded dependency belongs to a different skill ('landsat-download') than the advertised land-value-estimation skill. This kind of provenance mismatch is a supply-chain integrity issue because it can hide accidental package mix-ups, stale copied components, or deliberate substitution of code from another skill, reducing trust in what code is actually being shipped.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: This module centralizes access to multiple unrelated external-service credentials and makes them available to any importing skill code, far beyond the manifest’s stated land-value estimation purpose. In a skill context, broad credential plumbing increases the blast radius of compromise and enables unexpected data access or outbound use if other code in the skill invokes these helpers.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: Managing an OpenAI API key in a land-value estimation skill is unjustified from the visible scope and creates an unnecessary secret exposure path. If any part of the skill can call this helper, the skill may transmit prompts, data, or spend against an API not expected by the user.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Support for wildfire and meteorological service credentials expands secret handling beyond the declared land-value purpose without clear necessity. In agent skills, unrelated integrations are risky because they create covert capability expansion and increase opportunities for misuse of the user’s environment-provided secrets.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation states passwords are not cached, but load_user_secrets() copies secrets into the process-global _DEFAULTS map and reuses them after first load. This discrepancy is dangerous because it weakens operator assumptions about secret lifetime and increases exposure in long-lived processes, debugging, or memory inspection.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: This file implements a reusable arbitrary network downloader with resume, retries, and write-to-disk behavior for any caller-provided URL and destination path. In a land-value estimation skill, that is broader than the declared purpose and increases attack surface: a compromised or misused skill path could fetch untrusted content, store it locally, and enable follow-on misuse such as untrusted model/data ingestion or unwanted file placement.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The function accepts arbitrary URLs and caller-controlled filenames/paths, then writes downloaded data to disk with only optional hash validation. Even though the implementation includes safety features like temporary files and size limits, the core capability still permits acquisition of untrusted remote content unrelated to land-value estimation, which is dangerous if later consumed by other components or abused to place files in sensitive locations reachable by the process.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends user-supplied place queries and locale-related headers to third-party geocoding services, which can disclose sensitive location intent or private addresses to external providers. In a land-value-estimation skill, user AOIs may reflect proprietary site selection, investment targets, or personal address data, so silent transmission creates a real privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The function persists resolved place data under the user's home directory without any disclosure, retention control, or permission hardening. Cached AOI manifests can reveal sensitive search history, target geographies, or business analysis areas to other local users, backup systems, or later processes on the same machine.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code hardcodes a real-looking fallback username and password for Earthdata directly in source. Hardcoded credentials are highly dangerous because anyone with code access can reuse them, and any consuming skill can silently authenticate to an external service even when the user did not intend to provide credentials.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The code hard-codes an Accept-Language header of zh-CN for Nominatim requests without deriving it from user preference or documenting why. This can leak an implicit locale bias, alter returned place data in ways the user did not request, and create unnecessary privacy and compliance concerns around silent localization behavior.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 98% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 98% confidence
Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 92% confidence
Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15