Security audit
Security checks across malware telemetry and agentic risk
The documented LiDAR workflow is mostly local, but the package also ships under-disclosed network and credential-handling helpers that do not fit the offline privacy claim.
Install only after reviewing or removing the unused geocoding, download, and credential modules, especially credentials.py. Treat the offline/no-network claim as inaccurate for the full package, and use a constrained environment if testing it.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
"""env > 用户 secrets > .netrc > 默认."""
env_val = os.environ.get(env_name, "").strip()
if env_val:
return env_val_DEFAULTS: dict[str, str] = {
"EARTHDATA_USERNAME": "ruiduobao",
"EARTHDATA_PASSWORD": "Ruiduobao123",
"EARTHDATA_TOKEN": "", # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
"FIRMS_MAP_KEY": "",
"CMA_API_KEY": "",
"OPENAI_API_KEY": "",def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy
numpy rasterio scipy
numpy rasterio scipy
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution