Security audit

geoskill-light-pollution-assessment

Security checks for vulnerabilities and agentic risk

Overview

The main tool is a local light-pollution analyzer, but the package also ships undisclosed network, credential, and caching helpers including hardcoded Earthdata credentials, so it should go to Review.

Review this package before installing. The documented CLI appears to process local raster data, but the package includes extra helper code for network geocoding/downloads and credential lookup that is not explained in the user-facing skill instructions. Remove or isolate the unused credential/network modules, rotate the exposed Earthdata password, document any optional online behavior clearly, and pin dependencies before broad use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation declares no permissions, yet the analyzed capability set includes file access, shell execution, environment access, and network use. This is dangerous because operators may run the skill under an incorrect trust model, exposing local files, secrets in environment variables, or external connectivity that the documentation explicitly downplays as offline/local-only.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described purpose is narrowly scoped to offline light-pollution assessment, but the actual behavior reportedly includes external geocoding, download utilities, unrelated registries, credential handling, and even embedded default credentials. This mismatch is dangerous because it conceals high-risk functionality from users and reviewers, increasing the chance of secret exposure, unauthorized outbound requests, unexpected data collection, and abuse of bundled credentials.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The vendored core metadata claims the embedded core belongs to 'landsat-download' while this skill is described as a light-pollution assessment skill. That mismatch undermines supply-chain integrity and traceability: reviewers and tooling may validate or trust the wrong dependency set, increasing the chance that incorrect or unintended code is shipped unnoticed.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The checker claims to enforce that antimeridian-crossing bboxes are not allowed unless specially handled, but it only flags longitudes outside [-180, 180] and treats the common wrapped representation (W > E within range) as a generic ordering error. This can let downstream code mis-handle valid wrap-around extents or incorrectly reject them without explicit antimeridian logic, causing wrong area/extent calculations and potentially corrupt geospatial outputs.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The docstring claims passwords are not cached, but load_user_secrets() copies secrets into the process-global _DEFAULTS map and retains them for the life of the process. This creates a misleading security guarantee and increases exposure to accidental disclosure via debugging, memory inspection, or later code paths reading the mutated defaults.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The module hardcodes fallback Earthdata credentials directly in source code. Hardcoded credentials are dangerous because anyone with repository or package access can recover and reuse them, leading to unauthorized account use, abuse of upstream services, and secret propagation into forks, logs, and build artifacts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The functions send user-provided place queries to third-party geocoding services over the network without any disclosure or consent mechanism in this file. Place names can reveal sensitive user interests, locations, or operational targets, so silent transmission creates a meaningful privacy and data-governance risk.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The code hard-codes an Accept-Language value of zh-CN for Nominatim requests, overriding user preference and silently shaping how third parties process the request. While not directly leading to code execution or privilege compromise, it can affect privacy expectations, produce jurisdiction-specific responses, and create undisclosed behavior inconsistent with user intent.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 96% confidence
Finding: The dependency is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly introduced vulnerabilities. In a geospatial processing skill, this can undermine reproducibility and increase supply-chain risk because the runtime may pull an unexpected NumPy release.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio
Confidence: 95% confidence
Finding: The rasterio dependency is also unpinned, allowing non-deterministic installation of whatever version is current at build time. For a package that parses complex raster formats and links to native libraries, this raises supply-chain and reliability risk if a vulnerable or incompatible release is installed.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 89% confidence
Finding: The requirements file includes numpy without constraining it away from versions with known advisories, so vulnerable releases may be selected during installation. Even though this skill appears focused on raster analysis rather than direct exposure of NumPy internals, using a dependency with documented memory-safety and file-write issues increases risk in environments that process untrusted data or run with elevated filesystem access.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15