geoskill-map-algebra-calculator

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:14 PM UTC
• Version: 1.0.0

Overview

The advertised raster calculator is mostly local, but the package also contains under-disclosed network, download, cache, and credential-handling code.

Review this package before installing. The main calculator appears to perform local raster math, but the package includes extra modules that can access credential stores, use embedded fallback credentials, call external geocoding services, cache location lookups in the home directory, and download remote files. Install only if those modules are removed, isolated, or clearly disclosed and controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill metadata declares an offline, local raster calculator, but the analysis detected capabilities for environment access, filesystem read/write, shell, and network without any declared permissions. Even if some of these capabilities are only used by helper code, the lack of disclosure weakens trust boundaries and can lead users to run a skill with broader access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill presents itself as a safe offline band-math evaluator, but the detected behavior includes geocoding, external HTTP access, home-directory caching, general-purpose downloading, and credential handling with embedded default credentials. That combination greatly expands the attack surface and could expose user data, pull untrusted remote content, or misuse credentials in a context where users would reasonably expect no networked or credentialed behavior.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored core metadata claims the embedded core belongs to a different skill ('landsat-download') than the actual skill being analyzed. This undermines supply-chain traceability and reviewer trust, because operators may validate or approve the package based on incorrect provenance, potentially masking accidental or unauthorized code reuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file materially exceeds the declared skill scope of a safe raster band-math calculator by adding AOI geocoding, outbound HTTP requests, and persistent filesystem caching. In an agent skill, unjustified capabilities increase attack surface, can leak user-supplied locations to third parties, and violate least-privilege expectations even if the code is not overtly malicious.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-provided place queries to Open-Meteo and Nominatim, which is unrelated to the stated purpose of safe raster expression parsing. This creates a real privacy and supply-chain risk because sensitive location queries leave the local environment and depend on external services that can fail, log, or profile requests.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The module writes persistent cache files under the user's home directory, storing resolved place data without this being justified by the calculator's declared scope. Persistent local storage can expose user activity and queried locations to other local users, backups, or later processes, and broadens the skill's side effects beyond expected computation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module introduces broad credential-management capability for multiple unrelated external services into a skill whose stated purpose is raster map algebra evaluation. That mismatch materially increases attack surface and enables the skill to access sensitive secrets unrelated to its advertised function, which is dangerous in an agent/plugin context where users may grant trust based on the declared scope.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code resolves credentials for OPENAI, CMA, FIRMS, Earthdata, and EOG even though those services are not justified by the skill description. In a skill ecosystem, hidden access to unrelated secrets is a serious trust-boundary violation because it creates opportunities for unauthorized data access or later exfiltration if any other code path uses these helpers.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The documentation says passwords are not hardcoded, but the source embeds a real-looking fallback username and password in `_DEFAULTS`. Hardcoded credentials are directly exposed to anyone with source access and may grant unauthorized access if valid; the contradictory documentation also suggests concealment or at minimum highly unsafe security practice.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file introduces a reusable generic downloader with retry, resume, hashing, and atomic replacement, which is materially broader than the declared skill purpose of evaluating raster map-algebra expressions. In a calculator-style skill, adding network-enabled file acquisition expands the attack surface for remote content retrieval and local file creation without clear necessity, making misuse or abuse easier if upstream inputs are attacker-controlled.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code enables arbitrary outbound HTTP access to attacker-supplied URLs via requests/urllib, which is unjustified for a 'safe expression parser' skill. This creates SSRF-like risk and allows the skill to fetch untrusted remote content, potentially reaching internal services or acting as a network pivot depending on the execution environment.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The downloader writes fetched content to caller-controlled destination paths using absolute path resolution and batch mode accepts arbitrary filenames joined into the output directory. In a skill whose stated role is raster calculation, this unjustified file-write capability can overwrite or plant files on the local filesystem if untrusted inputs reach dest_path/filename, and combines dangerously with arbitrary network fetches.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements place resolution and AOI/geocoding behavior that is materially unrelated to the skill’s declared purpose of safe raster band-math evaluation. The mismatch expands the skill’s capability surface to include outbound network access and processing of user-supplied location queries, which increases privacy, supply-chain, and misuse risk because users and reviewers would not reasonably expect this behavior from a map-algebra calculator.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs live HTTP requests to Open-Meteo and Nominatim using user-provided place names, despite the skill being presented as a local safe expression parser for raster math. Hidden or unnecessary network access can leak sensitive user inputs, create dependency on external services, and violate least-privilege expectations for the skill context.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module docstring openly states that the file is an AOI adapter shim and migration layer, which contradicts the manifest’s stated map-algebra functionality. This kind of capability/intent mismatch is dangerous because it can conceal unexpected behavior during review and indicates the package may contain repurposed code outside its declared trust boundary.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: User-supplied place names are transmitted to third-party geocoding services without any visible disclosure in this file, creating a privacy issue. Location queries can be sensitive, and silent transmission undermines informed consent and may violate deployment expectations for a supposedly local raster calculator.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persistently stores resolved place data in a cache file in the user's home directory without visible disclosure or consent. This can leave behind a recoverable history of location-related inputs and outputs, which is sensitive metadata in many workflows.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The fallback values include a plausible real account and password, making this a direct secret exposure rather than a placeholder example. Even if intended for convenience, committed fallback credentials can be abused by anyone who obtains the repository and can also normalize insecure patterns for downstream developers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-supplied place queries are transmitted to external geocoding services without any visible disclosure, consent, or privacy gating in this code path. Even if the queries seem innocuous, location strings can contain sensitive personal, customer, or operational information, making silent exfiltration to third parties a real privacy and compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The Nominatim request hardcodes an Accept-Language preference for Chinese without user choice or documented necessity. While not directly code-execution dangerous, this can alter returned data, reveal assumptions about user profile or deployment region, and create unexplained behavior or privacy concerns inconsistent with a narrowly scoped calculator skill.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 88% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15