geoskill-location-allocation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:04 PM UTC
• Version: 1.0.0

Overview

The main location-allocation script appears local, but the package also ships undisclosed network, download, and credential-handling code, including embedded credentials.

Review this package before installing. The advertised allocation command appears to work locally, but the published artifact contains extra, undocumented capabilities for network geocoding, file caching, downloads, and credential lookup. Do not install in sensitive environments unless those vendored modules are removed or clearly disabled, the embedded credentials are removed and rotated, and dependency versions are pinned.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares fully offline, local-only behavior, yet static analysis detected capabilities for environment access, file read/write, shell execution, and network use without corresponding permission disclosure. Even if some capabilities are only indirect or unused in normal paths, the mismatch reduces auditability and could let the skill access local data or external services in ways users do not expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as an offline location-allocation tool, but analysis indicates additional geocoding, remote download, credential handling, and even hardcoded fallback credentials. That expands the trust boundary substantially and can expose secrets, trigger unintended outbound traffic, or process sensitive local/environment data under false pretenses.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored metadata declares a different skill identity ('landsat-download') than the advertised location-allocation skill, which strongly suggests a supply-chain packaging mismatch. Even in a metadata file, this discrepancy is dangerous because it can conceal inclusion of unrelated code paths, dependencies, or behaviors that reviewers and users would not expect from an optimization-focused skill.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The listed bundled files include download and credential-management functionality that appears unjustified for a location-allocation skill, expanding the attack surface beyond the stated purpose. If those modules are reachable, they could introduce hidden network access, secret handling, or misuse of credentials in a context where users would not anticipate such capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module performs outbound requests to third-party geocoding services using user-supplied place names, which can leak potentially sensitive operational or user location queries outside the local environment. In this skill context, location-allocation modeling does not obviously require undisclosed transmission to external services, so the hidden network capability meaningfully increases privacy and data-handling risk.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The code persists query results under the user's home directory, which can retain sensitive place queries and derived AOI data longer than expected. While not a direct code-execution issue, silent persistence creates privacy and data-retention risk, especially if users assume the skill is ephemeral or used for sensitive site-selection work.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The docstring claims passwords are not cached, but `load_user_secrets()` loads secrets into the module-global `_DEFAULTS` structure and retains them for the process lifetime. This creates unnecessary in-memory persistence of sensitive values, increasing exposure through memory inspection, debugging, crashes, or unintended reuse by other code in the same process.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Undisclosed network geocoding and persistent caching reduce informed user consent and can expose sensitive place inputs to external providers while also storing them locally. In a geospatial optimization skill, user inputs may represent confidential facilities, demand points, or planning targets, making silent transmission and retention more dangerous than in a generic consumer app.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials, including a concrete Earthdata username and password, directly in source code. Hardcoded secrets are dangerous because anyone with repository or package access can recover and reuse them, and they are hard to rotate, audit, or scope safely; in a shared skill ecosystem, this is especially risky because the skill is unrelated to secret management and may run in many environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code transmits raw user-provided place queries to third-party geocoding services without any disclosure or consent mechanism in the file. If users submit sensitive locations such as home addresses, facilities, or proprietary sites, that data is exposed to external providers and may be logged or retained outside the operator’s control.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: Forcing the Nominatim request header to 'zh-CN,zh;q=0.9' without user choice creates unnecessary metadata leakage about presumed locale and can bias results in ways users did not request. This is not severe on its own, but it reflects avoidable privacy and transparency issues, especially in multi-region or non-Chinese deployments.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 74% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 77% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 96% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15