geoskill-map-style-transfer

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:16 PM UTC
• Version: 1.0.0

Overview

The main style-transfer tool is local and coherent, but the package ships unrelated credential, geocoding, download, and cache utilities that are not disclosed for this skill.

Review this package carefully before installing. The documented command appears to perform local style transfer, but the bundle includes unrelated modules that can access credentials, make network requests, and write a persistent location cache if used. Prefer a version with only the style-transfer entrypoint and minimal shared helpers, with hardcoded credentials removed and network/credential behavior explicitly documented or excluded.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions while the analyzed implementation reportedly has capabilities for file access, shell execution, environment access, network use, and writing output. Even if some of these capabilities are only used by shared helper code, failing to disclose them weakens user consent and security review, and can mask higher-risk behavior if the skill is executed in a permissive runtime.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: a map-style-transfer skill should not need geocoding, remote downloads, multiple external services, or credential handling for Earthdata/FIRMS/CMA/OpenAI/EOG. The reported access to ~/.geoskill/secrets.json, .netrc, and embedded credential fallbacks materially increases the risk of secret exposure, unauthorized outbound requests, and hidden data access beyond the user’s expectations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the surrounding package ('geoskill-map-style-transfer'). This creates a supply-chain integrity and provenance problem: reviewers and automated tooling may validate or trust the wrong component set, making it easier to ship unintended or stale code under mismatched metadata.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file adds AOI geocoding, outbound network lookups, and persistent cache behavior that are not justified by the stated purpose of a map-style-transfer skill. Capability drift matters because unrelated code expands the attack and privacy surface: user-supplied place names are sent to third parties and location results are stored locally, creating unnecessary data exposure and supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code performs external requests to Open-Meteo and Nominatim using user-provided place queries, even though the skill is described as map-style transfer rather than geocoding. Unnecessary outbound requests can leak sensitive location intent, introduce dependency on third-party services, and broaden the skill's exfiltration surface without a clear functional need.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module persists resolved location manifests under the user's home directory by default, which is unnecessary for a style-transfer skill and creates local retention of potentially sensitive geographic queries. Persistent caches can outlive a session, be read by other local processes or users with access, and violate least-privilege expectations for the skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module is a centralized credential broker for multiple external services, including Earthdata, FIRMS, CMA, OpenAI, and EOG, despite the declared skill purpose being map style transfer. That broad secret-access surface is unnecessary for the stated function and enables unrelated credential harvesting or misuse if the skill imports this helper. The mismatch between purpose and privilege makes the file materially more dangerous in this skill context.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code reads sensitive data from environment variables, ~/.netrc, and ~/.geoskill/secrets.json, then makes those credentials available through helper functions without clear justification tied to map style transfer. Accessing broad user credential stores is dangerous because any downstream code using this module can silently obtain secrets intended for other tools or services. In this skill context, that is especially suspicious because style transfer does not inherently require external account credentials.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation explicitly says passwords are not hardcoded in skill source, but _DEFAULTS contains a real-looking Earthdata username and password. Hardcoded credentials are highly dangerous because anyone with source access can reuse them, and the contradiction suggests an attempt to normalize or conceal insecure secret handling. In a map-style-transfer skill, embedding live service credentials is wholly unjustified.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The exported API in this file performs place/AOI resolution and delegates to geocoding logic, which materially differs from the declared skill purpose of map style transfer. In an agent environment, this capability mismatch is dangerous because it introduces unexpected data flows and network-enabled behavior that users and reviewers would not anticipate from the manifest, undermining least privilege and trust boundaries.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The legacy resolver issues external HTTP requests to Open-Meteo and Nominatim for user-supplied place strings, even though the skill is described as a style-transfer tool. Unexpected outbound requests can leak sensitive user inputs, expand the attack surface to third-party services, and bypass reviewer expectations about what the skill does.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring explicitly states this file is an AOI/place adapter and migration shim, which contradicts the advertised map-style-transfer function of the skill. This discrepancy is a supply-chain and reviewability risk because it signals code reuse or hidden functionality that makes the delivered behavior harder to reason about and easier to misuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-provided place names are transmitted to third-party geocoding services without any disclosure or consent mechanism in this file. Location queries can reveal sensitive user interests, operations, or whereabouts, so silent transmission is a privacy weakness made more concerning by the skill's unrelated stated purpose.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Resolved location data is written to a persistent cache file in the user's home directory without disclosure in this code path. Even if the data seems low sensitivity, place queries and derived AOIs can reveal behavioral or geographic intent and should not be retained silently.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The _DEFAULTS table includes hardcoded fallback credentials, including a non-empty Earthdata username and password, while comments downplay their presence as centralized defaults. Even if intended as fallback behavior, embedding credentials in source creates immediate secret exposure and encourages silent authentication without informed user consent. The lack of a strong warning or hard failure makes accidental misuse more likely.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header preferring zh-CN without any user opt-in or contextual need tied to map style transfer. This can alter results in a user-unexpected way, reveal locale assumptions, and create privacy or fairness issues by forcing a regional preference during external lookups.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 93% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15