Security audit

Geoskill: Landsat Download

Security checks across malware telemetry and agentic risk

Overview

The main Landsat downloader is purpose-aligned, but the package includes an unrelated credential helper with embedded credentials and under-disclosed local secret/profile handling.

Review this package before installing in environments with real credentials or sensitive location work. The main downloader appears to search and download public Landsat data, but the bundled credential helper should be removed or fixed, exposed credentials should be rotated, and the geocoding/cache behavior should be disclosed or made opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The module claims that passwords are not hardcoded in source, yet `_DEFAULTS` contains a real Earthdata username and password. This creates an embedded secret in the codebase that can be recovered by anyone with source access and may be reused unintentionally across environments.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation states that passwords are not cached and are read on each call, but `load_user_secrets()` copies secrets from `~/.geoskill/secrets.json` into the process-global `_DEFAULTS` and keeps them in memory. This mismatch weakens operator expectations and increases exposure in long-lived processes, crash dumps, debugging sessions, or accidental introspection.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The privacy notice states that no environment variables are sent, but the code only disables proxy inheritance for some requests via Session.trust_env and uses plain requests.get() for asset downloads, which can still honor HTTP(S)_PROXY and related environment variables. This creates a documentation-to-behavior mismatch: outbound traffic may be routed through user-configured proxies or enterprise interception infrastructure, exposing requested URLs and metadata contrary to the stated disclosure.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The code sends user-supplied place queries to third-party geocoding services by default, which can leak sensitive location intent or personal data without explicit user awareness. In an agent skill context, place names may include home, work, customer, or incident locations, so undisclosed outbound requests create a privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill persists resolved queries and AOI results under the user's home directory by default, creating local storage of potentially sensitive location queries without explicit consent. On shared systems or managed environments, this can expose travel, residence, customer, or investigation locations to other local users, backups, or endpoint tooling.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Real fallback credentials are hardcoded in the module, making them available to anyone who can read the repository, package, logs, traceback context, or memory. In a credential helper, this is especially dangerous because other components may silently rely on the embedded account, spreading the secret across deployments and masking insecure configuration.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script automatically deletes the prior log file and recursively removes the test download directory at import/startup with no prompt or safety guard. While paths are fixed relative to the script, this can still cause unintended local data loss if the directory contains user data or if the path is replaced via symlink or repository misuse.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 97% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 84% confidence
Finding: requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:25