geoskill-lidar-powerline-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:02 PM UTC
• Version: 1.0.0

Overview

The main LiDAR tool appears local, but the package also ships under-disclosed credential, geocoding, download, and cache helpers, including hardcoded Earthdata credentials.

Review before installing. The documented CLI appears to run local LiDAR analysis, but the package includes unrelated credential and network-capable helpers. Do not install it in an environment with valuable ~/.netrc entries, ~/.geoskill/secrets.json, or sensitive API keys unless the publisher removes or clearly scopes those helpers and removes the hardcoded Earthdata credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation declares local/offline behavior and no explicit permissions, yet the detected capabilities include environment access, file read/write, network, and shell execution. This creates a trust and permission-transparency gap: users may run the skill believing it is constrained when it can access secrets, the filesystem, and external networks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: a LiDAR powerline analysis skill reportedly also performs geocoding, HTTP downloading, credential loading from environment/.netrc/secrets files, and even uses hardcoded NASA Earthdata fallback credentials. Hidden credential handling and undeclared network retrieval materially expand the attack surface and can lead to secret exposure, unauthorized external access, or misuse of third-party accounts.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the current LiDAR powerline detection skill. This indicates a supply-chain integrity or packaging provenance problem: reviewers and tooling may validate or trust the wrong component set, making it easier for incorrect or tampered dependencies to be shipped unnoticed.

Description-Behavior Mismatch

Low

• Confidence: 76% confidence
• Finding: The module persists user-provided place queries and resolved location data under the user's home directory without any visible consent or retention controls. While not directly enabling code execution, this creates a privacy leak on shared systems or in environments where home directories are later collected, synced, or inspected.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module introduces broad credential-management for multiple external services that are unrelated to the stated LiDAR powerline-detection purpose, greatly expanding the skill's secret-access and outbound-service surface. In this context, adding generic access to Earthdata, FIRMS, CMA, OpenAI, and EOG credentials creates unnecessary privilege and raises the risk that the skill can access or later misuse unrelated user secrets.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code explicitly handles OpenAI and several remote data-service credentials without a clear connection to extracting powerlines from LiDAR point clouds. In a narrowly scoped geospatial-analysis skill, unexplained multi-service credential access is suspicious because it enables collection of sensitive tokens the skill should not need.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The documentation claims passwords are not hardcoded in skill source, but the code embeds a real-looking default username and password in _DEFAULTS. Hardcoded credentials are highly dangerous because they can be extracted from source control, reused across environments, and silently authenticate to external services without user awareness.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The module states that passwords are not cached and are read each call, but user secrets are loaded into the _DEFAULTS process-global structure and then reused. This discrepancy matters because developers and users may rely on the non-caching claim when assessing exposure in long-lived processes, while the implementation keeps secrets resident in memory.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements place-name geocoding and network-based AOI resolution, which is materially unrelated to the declared LiDAR powerline detection purpose. Hidden or undeclared capabilities increase supply-chain risk because a consumer expecting offline/point-cloud analysis may unknowingly grant network access and process user-supplied locations through external services.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill makes outbound HTTP requests to external geocoding providers, sending user-supplied place queries and metadata such as the User-Agent, despite the skill being described as LiDAR powerline analysis. This creates privacy, exfiltration, and unexpected dependency risk because sensitive operational locations may be disclosed to third parties without clear necessity or user awareness.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: User-supplied place names are sent to third-party geocoding services without any visible consent, notice, or mode to force offline-only resolution. This can expose sensitive operational locations or project areas, which is more concerning in a geospatial/powerline-analysis skill where locations may reveal critical infrastructure work sites.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Writing resolved location data to a persistent cache in the user's home directory without visible disclosure can leak sensitive AOI history to other local users, backups, or host monitoring systems. In the context of LiDAR analysis for powerlines and towers, cached locations may reveal infrastructure assessment targets and therefore carry higher privacy sensitivity than ordinary map searches.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The module silently falls back to hardcoded credentials and auto-loads a user secrets file without any user-facing disclosure or consent in the code path. In the context of a LiDAR analysis skill, this is dangerous because users may not realize the skill can automatically discover and use sensitive credentials from their home directory.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Forcing the Accept-Language header to Chinese without user opt-in can leak assumptions about locale and alter provider responses in ways the user did not request. While not a severe exploit by itself, it is a privacy and transparency issue and can contribute to inaccurate or biased geocoding behavior.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 92% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 92% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 92% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 96% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 96% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 92% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15