geoskill-llm-spatial-query

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:03 PM UTC
• Version: 1.0.0

Overview

The main spatial-query tool is mostly local, but the package also ships under-disclosed network, downloader, and credential-handling code that does not fit the advertised offline purpose.

Review this skill carefully before installing. For the advertised offline query use case, ask the publisher to remove or clearly gate the geocoding, downloader, and credential modules; remove and rotate the hardcoded Earthdata credentials; disable home-directory caching by default; and pin dependencies. I did not find evidence of automatic exfiltration or destructive behavior in the main entrypoint, so this is Review rather than malicious.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (50)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares itself as offline/local spatial query tooling, but the detected capabilities include network, shell, environment access, and arbitrary file read/write without any corresponding permission declaration. Even if some capabilities are only indirect via dependencies or companion code, this mismatch weakens trust boundaries and can enable unexpected data access, command execution, or outbound communication in environments that rely on declared permissions for isolation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A strong description-behavior mismatch is a real security issue here because the skill is presented as an offline NumPy-equivalent spatial query tool, yet analysis indicates additional capabilities for geocoding, arbitrary HTTP downloads, credential handling with hardcoded fallback Earthdata credentials, and broader raster/remote-sensing utilities. This expands the attack surface significantly and may mislead users into running code with network and credential functionality they did not consent to, creating risks of secret exposure, unauthorized downloads, and unreviewed external interactions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The vendored metadata identifies the bundled component as a Landsat download skill, which conflicts with the advertised purpose of an offline natural-language spatial query tool. This kind of capability mismatch is dangerous because it can conceal unexpected network, file-handling, or data acquisition behavior from reviewers and users, defeating trust boundaries and making hidden functionality harder to detect.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Including safe_download.py, checks.py, and credentials.py in a skill described as offline spatial querying introduces unjustified download and credential-handling capabilities. In this context, those modules expand the attack surface for unauthorized network access, secret misuse, or future hidden behavior, and the mismatch makes the package materially more suspicious than if those capabilities were expected.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module advertises offline-first behavior, but it sends user-supplied place names to third-party geocoding services when the hardcoded lookup misses. In a spatial-query skill, location queries may be sensitive, and undocumented network egress creates a privacy and trust boundary violation even if it is not code-execution dangerous.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The code persists geocoding queries and results under the user's home directory without clear user consent. Place queries can reveal sensitive interests, addresses, or travel patterns, so silent local retention creates unnecessary privacy exposure on shared or managed systems.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring claims an ellipsoid-based computation with correction, but the implementation uses a simple spherical area formula based on a fixed radius. In geospatial workflows, inaccurate area computation can cause incorrect filtering, billing, quota enforcement, or policy decisions, especially if downstream components trust this function for scientific correctness.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module materially exceeds the stated purpose of an offline spatial-query skill by implementing broad credential discovery and retrieval logic for multiple third-party services. In skill ecosystems, unnecessary secret-access capability increases the blast radius: any other code in the skill can silently obtain credentials from environment variables, ~/.netrc, or ~/.geoskill/secrets.json, enabling unauthorized external access far beyond the declared functionality.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code is designed to resolve credentials for several unrelated external services, including OPENAI_API_KEY, despite the skill being described as an offline GeoPandas-equivalent spatial-query tool. This unjustified capability creates unnecessary secret exposure and makes it easy for unrelated code paths to pivot into external-service use with the user's credentials.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The docstring says secrets are not hardcoded in skill source, but _DEFAULTS contains a plaintext Earthdata username and password. Hardcoded credentials are a direct secret exposure: anyone with source access can reuse them, and the misleading documentation may prevent reviewers from noticing the leak.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module claims it does not cache passwords, yet load_user_secrets() copies secrets into the module-level _DEFAULTS dict and retains them for the process lifetime. This discrepancy weakens security guarantees and increases the chance of in-memory disclosure through debugging, dumps, or unrelated code reading module state.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file adds a general-purpose network downloader and local file writer to a skill whose stated purpose is offline natural-language spatial query processing. That capability materially expands the attack surface by enabling remote content retrieval and persistence unrelated to the advertised function, which can support data exfiltration, payload staging, or unauthorized asset fetching if exposed through the skill. In this skill context, the mismatch makes the behavior more suspicious and more dangerous than it would be in a downloader-oriented package.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The module performs arbitrary HTTP GET requests to caller-supplied URLs, despite the skill being described as offline spatial-query functionality. Unnecessary outbound network capability can be abused for SSRF-like access to internal resources, retrieval of malicious data, or covert communication, and there is no domain restriction or protocol limitation shown here. Because the manifest frames the skill as offline, this hidden online behavior is especially risky and misleading.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code writes downloaded data to an arbitrary destination path supplied by the caller, using only abspath normalization and no confinement to a safe base directory. That enables persistence of untrusted remote content anywhere the process can write, increasing the risk of overwriting application files, planting staged payloads, or consuming disk with attacker-chosen artifacts. In an offline query skill, such write capability is broader than necessary and therefore more dangerous.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it performs offline spatial query logic, but this file makes live HTTP requests to external geocoding services and can do so in a legacy fallback path. That creates undisclosed data egress of user-supplied place queries, breaks offline assumptions, and can expose users to privacy, compliance, and reliability risks in environments that prohibit network access.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring claims calls are unified through _geoskill_core, but the implementation silently falls back to legacy network-enabled resolution on import or runtime failure. This mismatch is dangerous because reviewers or operators may believe the module is using only the consolidated path while it can unexpectedly perform network activity and different logic under failure conditions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module performs external geocoding and local persistence of user queries without user-facing disclosure or consent. In this skill context, the input is natural-language location data, which can be sensitive, so undisclosed transmission and retention materially increase privacy risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: These lines hardcode fallback credentials, including a plaintext password, without any warning to users at the point of use. Silent fallback to embedded credentials can cause accidental use of shared or compromised accounts and conceals that authentication is happening with secrets the user did not explicitly provide.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This function silently reads a sensitive user secret file from the home directory and imports its contents into module state. Even without transmitting data itself, undisclosed secret harvesting behavior is dangerous in a skill context because users may not expect an 'offline spatial query' tool to inspect credential stores.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The _read_netrc helper automatically parses ~/.netrc and _netrc for credentials without user-facing disclosure. In a skill whose stated purpose is offline spatial analysis, automatically probing common secret files is unexpected and broadens the opportunity for credential misuse by any importer of this module.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: The code hard-codes Accept-Language to zh-CN for Nominatim requests without user choice or documentation. While not a direct code-execution issue, it can leak locale assumptions, alter query results in ways users did not request, and create privacy or policy concerns when combined with external requests.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 87% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15