Security audit
Security checks across malware telemetry and agentic risk
The main LiDAR tool is local, but the package also ships under-disclosed network and credential helper code, including hardcoded Earthdata credentials.
Review this package before installing in an environment with valuable credentials. The main LiDAR command appears local, but the distribution includes extra helper modules that can use network services and read local credential stores, and it contains hardcoded Earthdata credentials. Prefer a cleaned package that removes unused network/credential helpers, rotates/removes embedded credentials, documents any online features, and pins dependencies.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _resolve(name: str) -> str:
"""env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
env_val = os.environ.get(name, "").strip()
if env_val:
return env_valdef _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
"""env > 用户 secrets > .netrc > 默认."""
env_val = os.environ.get(env_name, "").strip()
if env_val:
return env_valdef load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy geopandas
numpy rasterio scipy geopandas shapely
numpy rasterio scipy geopandas shapely
numpy rasterio scipy geopandas shapely
rasterio scipy geopandas shapely
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution