geoskill-lulc-change-matrix

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:11 PM UTC
• Version: 1.0.0

Overview

The advertised raster analysis tool is mostly local, but the package includes under-disclosed network, caching, and credential-handling code including hardcoded Earthdata credentials.

Install only after reviewing or removing the bundled _geoskill_core credential, download, and AOI/geocoding helpers, rotating/removing the embedded Earthdata credentials, and documenting any network or credential behavior. The main CLI appears intended for local raster processing, but the packaged support code is broader than the user-facing skill description.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill declares no permissions, yet static analysis indicates capabilities for environment access, file read/write, network, and shell execution. Even if some of these are only in supporting code, undeclared sensitive capabilities reduce transparency and can enable data access, command execution, or exfiltration beyond the stated local raster-analysis purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: This is a strong description-behavior mismatch: the skill is presented as an offline local raster cross-tabulation tool, but the analyzed behavior includes geocoding/network calls, remote download logic, credential harvesting locations (.netrc, env, secrets), and even embedded default Earthdata credentials. Hidden network and credential-handling paths are particularly dangerous because users may trust the skill with local geospatial data while it can access secrets or contact external services unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata declares the embedded core as belonging to a different skill ('landsat-download') than the actual skill being analyzed. This breaks provenance and integrity expectations for vendored components, making it easier to ship mismatched or unintended code under misleading metadata and weakening review, auditing, and supply-chain trust.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module centralizes access to multiple unrelated third-party credentials (OpenAI, CMA, FIRMS, EOG, Earthdata) inside a skill whose stated purpose is land-cover change-matrix computation. Broad credential reach violates least privilege and increases the blast radius if this skill or its runtime is abused, because it can probe or consume secrets not needed for its advertised function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code not only reads multiple categories of credentials, but also exposes their availability and source via describe_credentials(). Even without returning secret values, this reveals what external services are configured in the environment, which is useful reconnaissance for follow-on abuse and is unjustified for the declared skill function.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded in skill source, yet the module embeds a default Earthdata username and password in _DEFAULTS. Hardcoded credentials can be extracted from source control, package artifacts, logs, or prompts, enabling unauthorized account use and undermining trust in the credential model.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file adds place-resolution and AOI geocoding behavior that is not aligned with the declared purpose of a land-cover change-matrix skill. In an agent setting, capability drift is dangerous because it silently expands what the skill can do, including processing arbitrary place strings and initiating location-resolution workflows that may influence downstream geographic scope and data handling.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs outbound HTTP requests to third-party geocoding services, which creates undeclared data egress and expands the skill's trust boundary beyond local raster analysis. If user-supplied place names or sensitive AOI identifiers are sent externally, this can leak operational context, enable tracking by external services, and introduce nondeterministic behavior or dependency abuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-supplied place names are sent to Open-Meteo and optionally Nominatim, disclosing potentially sensitive locations to third parties without any in-code notice or consent mechanism. In a geospatial workflow, place queries can reveal research targets, customer sites, or operational areas, making silent outbound transmission a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Resolved query data is persisted under the user's home directory, creating a local history of searched places and derived AOI metadata without visible disclosure here. That can expose sensitive geographic interests to other local users, backup systems, endpoint monitoring tools, or later forensic review, especially on shared or managed machines.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: Forcing `Accept-Language: zh-CN,zh;q=0.9` leaks a locale preference to the external service and overrides user/environment expectations without consent. The direct security impact is limited, but it unnecessarily increases fingerprinting/privacy exposure and may affect returned results in ways the user did not choose.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module ships with live-looking fallback credentials and no warning or interactive consent before use. That means a user may unknowingly run under someone else's account, and an attacker who obtains the source immediately gains usable credentials or a credential target for abuse.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice is an unnecessary policy decision that may alter returned results and disclose localization assumptions to an external service. While not as severe as the outbound request itself, it reduces user control and can bias geocoding outcomes in ways that are inconsistent with a general-purpose analysis skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
pandas

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
pandas

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
pandas

• Confidence: 96% confidence
• Finding: pandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15