geoskill-map-symbology-optimizer

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:18 PM UTC
• Version: 1.0.0

Overview

The documented tool is a local map styling optimizer, but the package also includes unrelated credential, geocoding, caching, and download code that users are not told about.

Review this skill before installing. The main documented command looks local, but the package should be cleaned up to remove or clearly disclose the unrelated credential, geocoding, cache, and download helpers. Do not use it in an environment with sensitive ~/.netrc, ~/.geoskill/secrets.json, or service credentials unless you have audited and constrained those modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation declares no permissions, yet the detected capabilities include shell, filesystem, environment access, network, and file write operations. This creates a trust and review gap: users may invoke a seemingly local/offline symbology tool without realizing it can access sensitive local data or perform external actions. The stated offline/privacy posture makes the undeclared capability set more concerning, because it could mislead users about actual execution risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a strong description-behavior mismatch: a map symbology optimizer should not need geocoding, remote downloading, credential management for multiple services, or reading secrets from ~/.geoskill/secrets.json and .netrc. The presence of secret-reading logic and especially hardcoded fallback credentials substantially increases risk, because the skill could access local credentials or external services far beyond its declared purpose, violating user expectations and enabling data exfiltration or unauthorized network activity.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored core metadata claims this package is for the unrelated skill 'landsat-download' while the surrounding skill is a map symbology optimizer. This kind of identity mismatch undermines supply-chain integrity and can indicate the wrong vendored core was copied in, causing reviewers and tooling to trust or load code based on incorrect provenance.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements place geocoding, outbound HTTP requests, and persistent filesystem caching, which are materially unrelated to a map symbology optimization skill. In a least-privilege review, this kind of hidden capability expansion is dangerous because it enables user-input exfiltration and local data persistence beyond the stated purpose, increasing attack surface and violating user expectations.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The code sends user-supplied place queries to external geocoding services (Open-Meteo and optionally Nominatim) despite the skill being described only as a symbology optimizer. Unnecessary network egress is dangerous because it can leak sensitive location intent and create undisclosed third-party dependencies that may be abused or fail unpredictably.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module stores query-derived AOI manifests in a persistent cache under the user's home directory without any obvious need tied to symbology optimization. Persistent local storage of location lookups can expose sensitive user interests or work context to other local processes/users and leaves data behind longer than users expect.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file is a credential-management module embedded in a skill whose stated purpose is map symbology optimization, creating a strong mismatch between declared functionality and actual behavior. That mismatch matters because the code centralizes access to multiple credentials and local secret stores, expanding privilege and making covert data access more plausible than for a purely visual-design skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module includes retrieval paths for Earthdata, FIRMS, CMA, OpenAI, and EOG credentials even though the skill is described as optimizing map symbology. Access to unrelated service credentials increases the blast radius if the skill or surrounding agent is compromised and suggests over-collection beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads from user-level secret stores and .netrc files, which are highly sensitive locations, despite no clear relationship to symbology optimization. Even without immediate exfiltration in this file, broad secret discovery capabilities are dangerous because they normalize unauthorized credential harvesting paths within an unrelated skill.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring claims passwords are not cached, but load_user_secrets mutates the in-memory _DEFAULTS structure and a loaded flag prevents rereading, so secrets persist in process memory. Misstating secret-handling behavior can cause operators to underestimate exposure in long-lived agent processes and weakens security review assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This file exposes a generic remote download primitive that can fetch arbitrary URLs, write attacker-controlled content to local disk, resume partial downloads, and batch-download multiple files. In a skill whose stated purpose is map symbology optimization, that capability is unnecessary and expands the attack surface for data exfiltration, malware staging, or retrieval of untrusted code/data if any caller can influence the URL or destination.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a visual map symbology optimizer, but the implementation includes arbitrary remote downloads with local file writes, creating a capability mismatch. This hidden or non-obvious functionality is dangerous because it gives the skill broader operational power than users would expect, making misuse or supply-chain style abuse harder to detect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file exposes place-resolution and network geocoding behavior even though the skill is described as a symbology optimizer. That mismatch is security-relevant because it expands the skill's data access and outbound network behavior beyond user expectations, creating an unnecessary channel for transmitting user-supplied location data to external services.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs HTTP requests to external geocoding providers using user-supplied place names, which is unrelated to the stated symbology-optimization context. In this context, unsolicited outbound requests are dangerous because they can leak sensitive queries, create unexpected third-party dependencies, and conceal broader data exfiltration capability inside a seemingly local visualization skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User place queries are persisted to disk via cache entries without any disclosure in this file, which creates a privacy risk. Even if the filenames are hashed, the manifest contents still retain resolved locations and can reveal sensitive usage patterns or project context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code transmits user-supplied place queries to an external geocoding API without any user-facing warning in this component. For a skill whose declared purpose is visual symbology optimization, that undisclosed data sharing is a significant privacy and trust issue.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The Nominatim fallback also sends user queries externally and adds locale headers, increasing the amount of context disclosed to a third party without clear notice. Hidden fallback behavior is especially risky because users may not realize additional services receive their input when the primary lookup path changes.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Hard-coding an Accept-Language preference of zh-CN influences third-party responses and reveals an implicit locale preference without user choice. While lower severity than raw query exfiltration, it still creates unnecessary privacy leakage and behavior coupling inconsistent with the stated skill purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-provided place queries are sent to third-party services without any user-facing warning or consent mechanism in this file. Even if the query looks harmless, place names can reveal travel, residence, business, or investigative intent, so silent transmission to external providers creates a privacy and trust issue.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for Chinese without user opt-in. This is not severe on its own, but it can override user expectations, influence returned content, and reveal localization assumptions about the user or deployment context.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 97% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 97% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 97% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 98% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15