geoskill-least-cost-path

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:15 PM UTC
• Version: 1.0.0

Overview

The main path tool appears local, but the package includes undisclosed network, download, and credential-handling code that does not fit the stated offline purpose.

Review this package before installing. The main CLI may work offline, but the bundle contains extra modules that can access credential stores, contact third-party geocoding services, download remote content, and persist cache files. Install only if you trust the publisher and are comfortable with those undeclared capabilities, or remove the unrelated helper modules and hardcoded credentials first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform local least-cost-path analysis offline, yet the finding indicates geocoding, remote downloads, credential handling, environment/.netrc/secrets reads, and even embedded default Earthdata credentials. Hidden network access and secret collection materially expand the attack surface and can enable credential leakage, unauthorized external communication, and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata claims the packaged core belongs to a different skill ('landsat-download') than the declared least-cost-path skill. This indicates a supply-chain integrity or packaging mismatch: maintainers and automated tooling may trust, review, or hash-verify the wrong component, increasing the chance of shipping unintended code or silently reusing an unrelated dependency bundle.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This helper goes beyond pure least-cost-path computation by transmitting user-supplied place names to external geocoding services and optionally persisting results locally. In a geospatial skill this may be functionally convenient, but it expands the trust boundary and can leak sensitive location queries or create side effects users do not expect from an algorithmic path computation module.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code contacts Open-Meteo and Nominatim with user-provided place data, which is a real data-exposure and unexpected-network-behavior issue even if not overtly malicious. Because the declared skill is least-cost-path computation, this hidden external dependency increases privacy risk and operational surprise, especially in restricted or offline environments.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: Setting a default cache directory under the user's home directory enables persistent storage of geocoding-derived data outside the core path-computation purpose. This is lower severity than network exfiltration, but it can still leave location-related artifacts on disk without the user's awareness.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module is far broader than the stated least-cost-path skill purpose and centralizes access to multiple external-service credentials, including OpenAI, Earthdata, FIRMS, CMA, and EOG. In a skill whose declared function is local path-cost computation, this creates unnecessary secret-access capability and expands the attack surface for credential harvesting or later exfiltration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code silently reads sensitive values from ~/.geoskill/secrets.json, environment variables, and ~/.netrc/_netrc for several unrelated external services. Even without direct exfiltration in this file, unnecessary secret discovery logic inside an unrelated skill materially increases the risk that downstream code can access and misuse user credentials.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The module’s purpose diverges materially from the declared skill purpose: instead of least-cost path computation, it introduces a reusable network downloader with local file-write capability. In an agent/skill environment, undeclared download-and-write behavior expands the attack surface, enables payload staging or unauthorized data ingress, and makes review and policy enforcement harder because the capability is hidden behind an unrelated manifest.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: This code adds generic HTTP GET capability for arbitrary URLs, which is a powerful primitive unrelated to the stated geospatial path-computation purpose. In practice, such capability can be abused for unauthorized outbound requests, downloading attacker-controlled content, or acting as a stepping stone for SSRF-like access if internal URLs or sensitive endpoints can be supplied by untrusted input.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The downloader writes arbitrary remote content to caller-chosen local paths, which exceeds the declared computation-only scope and creates a file-write primitive. Even with .part files and atomic replace, this can be dangerous if untrusted inputs control filenames or destinations, because it can overwrite sensitive files, plant malicious artifacts, or persist unwanted data on the host.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The public API delegates place resolution to a geocoding component, which is outside the stated least-cost-path purpose of the skill. Even if not overtly malicious, this expands the skill’s capabilities and data handling surface, allowing user-supplied location queries to be processed in a way users may not expect from a path-computation skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The legacy fallback preserves external geocoding network access through Open-Meteo and Nominatim, which is unrelated to least-cost-path calculation and materially increases the attack and privacy surface. Because the fallback activates when the core import fails, networked behavior may occur unexpectedly, making the hidden capability more dangerous than a clearly separated optional module.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code contains active network geocoding functions that send user input to third-party services without clear necessity for the declared least-cost-path functionality. In this skill context, that unjustified capability is risky because it enables outbound data transfer and dependency on external services beyond the advertised behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cache write path stores manifests derived from user-supplied place queries to disk without any visible disclosure at the API boundary. If place names are sensitive (home, facility, incident location), this creates local privacy leakage and forensic residue that users may not expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Outbound geocoding requests send user-provided place names to third parties without explicit warning at the call sites or API contract. In this skill context, AOI input can contain sensitive location intent, so silent transmission is a meaningful privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: After one external lookup, the code may forward the same location query to a second external service, further widening disclosure beyond what a user might expect. Chaining providers increases privacy exposure, dependency risk, and policy-compliance concerns because query data is shared with multiple third parties.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The source code contains hardcoded fallback credentials, including a plaintext username and password. Hardcoded secrets are immediately recoverable by anyone with repository or package access, can be reused unintentionally in production, and may expose the associated external account to compromise or abuse.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The module automatically loads a sensitive secrets file from the user's home directory without any explicit user action at the point of use. In the context of a least-cost-path skill, this hidden behavior is risky because it normalizes broad credential access and can surprise users who did not expect this skill to inspect personal secret stores.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The geocoding requests transmit raw user-provided place queries to external services, but this file provides no user-facing disclosure or consent mechanism. That creates a privacy issue because place names can reveal sensitive travel, residence, or operational interests, especially in a geospatial workflow.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 90% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15