geoskill-lidar-coastal-erosion

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:02 PM UTC
• Version: 1.0.0

Overview

The main tool is a local coastal-analysis script, but the package also includes undisclosed credential/network helper code and can produce modeled results where real two-period data is implied.

Review before installing. The visible CLI is mostly local geospatial processing, but the package should remove or clearly gate unused credential/geocoding/download helpers, delete hardcoded credentials, pin dependencies, correct vendored provenance, and clearly label synthetic or modeled outputs before users rely on results.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions, yet the documented and detected capabilities include shell, file read/write, environment access, and network access. This creates a trust boundary failure: users and orchestrators cannot accurately assess what the skill may access, increasing the risk of unintended data exposure, credential use, or external communications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The claimed purpose is narrow LiDAR coastal erosion analysis, but the detected behavior includes geocoding, HTTP downloading, credential harvesting from environment/.netrc/secrets files, and even hardcoded default credentials. This is a strong mismatch that suggests hidden functionality unrelated to the advertised task, which could enable secret exfiltration, unauthorized remote access, or abuse of user trust.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the actual LiDAR coastal erosion skill. This creates a supply-chain integrity gap: reviewers and tooling may validate or trust the wrong component lineage, making it easier for mismatched or unauthorized code to be shipped without detection. In this context, the mismatch is more dangerous because the file is specifically meant to attest vendored provenance and hashes, so incorrect identity undermines the purpose of the control itself.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: User-supplied place names are sent to third-party geocoding services, which can leak potentially sensitive location intent and create unneeded network data flows for a skill that is described primarily as LiDAR coastal-erosion analysis. In this context, undisclosed external transmission is a real privacy/security concern even if the implementation is functionally legitimate.

Context-Inappropriate Capability

Low

• Confidence: 77% confidence
• Finding: The code writes geocoding cache files under the user's home directory without an explicit per-run consent mechanism. While not a code-execution issue, it creates persistent local artifacts that may reveal queried places or AOIs and is an unnecessary side effect for users expecting read-like analysis behavior.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This module implements a centralized credential broker for multiple external services that are broader than the stated coastal LiDAR erosion purpose. In a skill context, broad credential-handling code expands access scope and creates an unnecessary secret exposure surface, especially when combined with helper APIs that make credential retrieval easy for unrelated downstream code.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The module explicitly supports OPENAI, FIRMS, CMA, and EOG credentials even though the manifest describes LiDAR/DSM coastal erosion analysis. Access to unrelated secrets is dangerous because any code path in the skill can potentially retrieve and misuse credentials that users did not expect this skill to touch.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation claims passwords are not hardcoded, but the module contains a hardcoded default Earthdata username and password in `_DEFAULTS`. Hardcoded credentials are a severe secret-management failure: they can be extracted from source control, reused by anyone with code access, and may provide unauthorized access to external services.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The code advertises two-epoch coastal erosion analysis but, when only one input is provided, silently generates a synthetic second epoch and computes erosion/EPR outputs as if they were derived from real observations. This is dangerous because it can produce fabricated scientific results that may be mistaken for real geospatial evidence, leading to incorrect operational, regulatory, or planning decisions.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The usage text implies that supplying a bbox or a single input point cloud performs real analysis, but the implementation can instead model change rather than compare two observed epochs. Misleading documentation increases the chance that users rely on outputs for real-world coastal change assessment without realizing the results are synthetic or partially synthetic.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The file sends place queries to Open-Meteo and potentially Nominatim without any obvious user-facing disclosure in this code path. Because place names may encode sensitive project locations, this is a meaningful privacy weakness in the context of a geospatial analysis skill.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: Caching resolved place data in the user's home directory without explicit warning or consent can expose historical AOI lookups to other local users, backup systems, or later forensic review. In a geospatial workflow, these cached locations may reveal sensitive survey areas or customer interests.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The fallback credential block includes hardcoded authentication data that is silently used when environment variables are absent. This is dangerous because users and operators may unknowingly authenticate with embedded shared credentials, masking insecure behavior and increasing the risk of credential abuse, leakage, or account compromise.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: User-supplied place queries are sent to third-party geocoding services without any disclosure or consent mechanism in this code path. Even if the data seems non-sensitive, location queries can reveal operational interests, project sites, or user intent, creating a privacy and data-governance risk.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Forcing the Accept-Language header to zh-CN leaks an implementation preference and may influence provider responses in a way the user did not request. This is a privacy and policy issue rather than a severe exploit path, but it can mis-handle international users and unnecessarily discloses locale assumptions to a third party.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 99% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 74% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15