geoskill-logistics-optimization

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:04 PM UTC
• Version: 1.0.0

Overview

The route optimizer entrypoint is mostly local, but the package includes unrelated credential, geocoding, download, and remote-sensing code that is not clearly disclosed by the skill description.

Review before installing. The visible route-optimization CLI appears local, but install it only in an environment where you are comfortable with bundled code that can read credential files and perform network geocoding/downloads if invoked. Avoid running it where sensitive ~/.netrc or ~/.geoskill/secrets.json credentials are present unless the unrelated modules are removed or audited.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill manifest/documentation declares no permissions, yet the analyzed capability set indicates access to environment variables, filesystem, shell, and network. That mismatch can mislead users and orchestrators about the true execution surface, reducing informed consent and weakening sandboxing or approval decisions. In this logistics context, those capabilities are broader than necessary for an offline route optimizer and therefore materially increase risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform local logistics optimization, but static analysis attributes unrelated behaviors including external geocoding/network access, credential handling for multiple third-party services, remote data download logic, and embedded fallback secrets handling. Such hidden functionality is dangerous because it can exfiltrate data, use unauthorized credentials, or pull untrusted remote content under the guise of an offline optimization tool. The logistics context makes this more suspicious, not less, because these behaviors are unnecessary for the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata declares the embedded component as 'landsat-download', which does not match the stated skill purpose of logistics route optimization. This kind of provenance mismatch is dangerous because it can indicate a supply-chain packaging error, hidden functionality, or repurposed code that was not reviewed for the current skill's threat model, increasing the chance of unexpected behavior or unauthorized data handling.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code persists geocoding results under the user's home directory, creating a local record of user-supplied location queries. Even though filenames are hashed, the JSON content stores the original query and resolved location data, which can expose sensitive operational or personal location information to other local users, backups, or forensic collection.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module centralizes credential access for multiple external services that do not align with a logistics route-optimization skill. In an agent-skill context, broad secret-handling capability unnecessarily expands the trust boundary and creates an opportunity for unrelated credential harvesting or later misuse if other code paths consume these helpers.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code advertises and implements access to credentials for OpenAI, Earthdata, FIRMS, CMA, and EOG without clear justification from the skill’s stated logistics function. Even without immediate exfiltration in this file, collecting and normalizing unrelated secrets is dangerous because it prepares a convenient abstraction for broader credential access than users would reasonably expect.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The module hardcodes a fallback Earthdata username and password directly in source. Hardcoded live credentials are highly sensitive because anyone with repository or package access can reuse them, and downstream code may silently authenticate with a real external account without the user realizing it.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring explicitly claims credentials are not hardcoded in source, yet the module contains hardcoded fallback credentials. This mismatch is dangerous because it can mislead reviewers and users into trusting the module, reducing scrutiny around a real secret exposure and unexpected credential use.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This module provides a generic remote file download primitive with arbitrary URL input, local path writes, resume support, and batch download capability, which is broader than a logistics route-optimization skill needs. In an agent setting, such a helper can be repurposed to fetch untrusted payloads, stage data locally, or enable SSRF-style access to internal resources if upstream callers pass attacker-controlled URLs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: File-based caching writes manifests containing user queries and derived geographic data to disk without clear disclosure or consent. In a logistics context, place names may reveal customer addresses, depots, routes, or commercially sensitive areas, so silent persistence increases privacy and operational security risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: External requests send user-provided place strings to Open-Meteo and optionally Nominatim, disclosing potentially sensitive location intent to third parties. For logistics optimization, those queries can encode customer sites, hubs, or delivery regions, so silent transmission can leak business-sensitive or personal data outside the local environment.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded fallback credentials are present and can be used silently, with no warning to users that real external authentication may occur. In a logistics skill, this is especially suspicious because users would not expect bundled third-party credentials unrelated to core routing functionality.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The code hard-codes `Accept-Language: zh-CN,zh;q=0.9` for all Nominatim requests, regardless of user preference or deployment context. This can cause silent locale coercion, mis-resolution of place names, and unnecessary disclosure of geographic/language assumptions to a third-party service, which is a security/privacy concern in multi-tenant or regulated environments.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 85% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15