Security audit

Geoskill: Landcover Download

Security checks across malware telemetry and agentic risk

Overview

The main downloader is mostly coherent, but it bundles an unrelated credential module with hardcoded Earthdata credentials and under-disclosed secret/cache handling, so it needs Review before use.

Install only after reviewing or removing the bundled credential module and rotating the exposed Earthdata account if it is real. Use --bbox instead of --place if you do not want place queries sent to geocoding services, and be aware that place lookups may be cached in your home directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The docstring states the function applies a WGS84 ellipsoidal formula with an ellipsoid correction, but the implementation actually uses a simple spherical trapezoid area formula with radius WGS84_A. In a geospatial validation module that is supposed to enforce scientific correctness before writing outputs, this mismatch can cause downstream code or analysts to trust area estimates as higher fidelity than they are, leading to systematic decision errors, especially for large extents or high latitudes.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module documentation says passwords are 'not cached', but `load_user_secrets()` copies secret values into the process-global `_DEFAULTS` dict and keeps them for the lifetime of the process. That mismatch is security-relevant because operators may rely on the documented non-retention property when deciding whether the module is safe to use in long-lived agent processes, increasing exposure of secrets in memory and in later debug/introspection paths.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The `get_earthdata_token()` docstring claims `.netrc` `account` field support, but the implementation only calls `_resolve("EARTHDATA_TOKEN")`, which never parses `.netrc`. This discrepancy can cause operators to place a token in `.netrc` expecting it to be used securely, while the code silently falls back to other sources, including hardcoded defaults or empty values, leading to misconfiguration and unintended authentication behavior.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The code sends user-supplied place queries to third-party geocoding services and also persists resolved AOI data under the user's home directory without any built-in disclosure or explicit consent mechanism. In a skill context, place names can contain sensitive location intent or personal context, so silent network transmission and durable local storage create a privacy and data-handling risk even though this is not code-execution or direct compromise.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This file contains hardcoded fallback credentials, including a concrete username and password, directly in source code. Even if described as defaults, embedded credentials are recoverable by anyone with repository or package access, can be reused unintentionally across installations, and normalize unsafe secret handling in a credential-management module.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The code hard-codes the Accept-Language header to "zh-CN,zh;q=0.9" for Nominatim requests, overriding user or environment preferences without consent or documentation. This can leak locale assumptions to a third-party service and bias returned results toward Chinese-localized data, creating privacy and correctness issues in a geocoding component that performs external network lookups.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:25