geoskill-metadata-standards-checker

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:17 PM UTC
• Version: 1.0.0

Overview

The advertised XML metadata checker is mostly local, but the package also ships undocumented credential, downloader, and geocoding code, including hardcoded Earthdata credentials.

Review this before installing. The visible checker workflow is local, but the bundle carries unrelated network and credential code. Install only in an environment where you are comfortable exposing local environment variables and credential files to this skill's code, and remove or isolate the bundled credential/geocoding/downloader helpers if you only need offline XML validation. The hardcoded Earthdata credentials should be treated as exposed and rotated if they are real.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions, yet its documented capabilities imply access to environment variables, files, shell execution, and network resources. This creates a trust and sandboxing gap: operators may approve the skill assuming low privilege, while the implementation can access substantially more sensitive surfaces than disclosed.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: a metadata XML validator is reported to also perform unrelated geocoding, downloading, raster QA, credential handling, and even embedded fallback credential use. Hidden network access and secret-handling logic greatly expand the attack surface and can enable data exfiltration, unauthorized external calls, or misuse of embedded credentials under the guise of a harmless offline validator.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The vendored metadata claims this package contains code for the different skill 'landsat-download' even though the analyzed skill is a metadata-standards checker. This kind of component/identity mismatch is a supply-chain integrity problem: reviewers and deployment tooling may believe they are installing one capability while actually receiving another codebase or mixed package, which can hide unintended network access, credential handling, or other behavior unrelated to the declared skill.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file adds AOI place-resolution and remote geocoding capabilities that are not aligned with a metadata-standards-checking skill, materially expanding the skill’s permissions and data flows. In this context, hidden or unnecessary network-enabled geocoding is dangerous because user-supplied place names may be exfiltrated to third parties and the skill gains behavior outside its stated purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user queries to Open-Meteo and Nominatim over the network even though the declared skill purpose is XML metadata validation, not geocoding. This creates an unnecessary external data exfiltration path and introduces third-party dependency, privacy, and integrity risks that users would not reasonably expect from a metadata checker.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The module is configured to persist cache data under the user's home directory, which is an unjustified write capability for a standards-checking skill. Persisting resolved locations can leave behind sensitive user-derived data, create unintended cross-run state, and surprise users who expect a read-only validator.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module centralizes retrieval of multiple credentials and access paths unrelated to the stated XML metadata validation purpose, materially expanding the skill’s privilege surface. In the context of a metadata checker, adding broad credential handling for Earthdata, FIRMS, CMA, OpenAI, and EOG increases the chance the skill can access or facilitate access to external services far beyond its declared function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The helpers expose retrieval of multiple external-service credentials with no clear justification from the skill’s declared purpose of validating ISO 19115 / FGDC XML. Unnecessary secret access is dangerous because any downstream code in the skill can call these helpers to obtain sensitive tokens or passwords and use them for unintended network actions.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The module claims secrets are not hardcoded, yet `_DEFAULTS` contains a real-looking Earthdata username and password. Hardcoded credentials are highly dangerous because they can be extracted from source control, reused by anyone with code access, and may provide direct unauthorized access to external services.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements a full-featured downloader with retry, resume, hash verification, and atomic file replacement, which materially exceeds the declared purpose of XML metadata parsing and validation. In a skill whose manifest describes metadata standards checking, this broader capability increases attack surface by enabling arbitrary remote retrieval and local persistence of content unrelated to the stated function.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The `_http_get` helper provides generic HTTP fetch capability for arbitrary URLs using either `requests` or `urllib`, with no allowlist, protocol restriction, or linkage to trusted metadata sources. This can be abused for unexpected outbound network access, including fetching attacker-controlled payloads or accessing internal resources if untrusted input can influence the URL.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The download routine writes arbitrary content to caller-selected filesystem paths, including resumable `.part` files and final atomic replacement, without confining writes to a dedicated safe directory. In the context of a metadata checker, this is broader than necessary and could enable unintended file creation or overwrite in sensitive locations if downstream callers pass untrusted paths or enable overwrite behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements place geocoding and AOI network resolution logic that is materially unrelated to the stated skill purpose of parsing and validating ISO 19115 / FGDC XML metadata. Hidden or unjustified capabilities are dangerous because they expand the trust boundary, may exfiltrate user-provided location data to third parties, and indicate the skill may perform actions users would not expect from its manifest.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code contacts external geocoding services (Open-Meteo and Nominatim) even though the skill is described as a metadata XML standards checker. For this context, external geocoding is unjustified functionality that can leak user-supplied place names and create an unexpected outbound network dependency inconsistent with the advertised purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Location queries are transmitted to third-party geocoding services without any visible consent, warning, or privacy disclosure in code paths likely to be called automatically. Even if the data seems low sensitivity, place names can reveal user interests, work locations, project areas, or other contextual information and therefore constitute a privacy risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module caches resolved location data to disk in the user's home directory without explicit disclosure or consent. This can retain potentially sensitive lookup history and create a privacy exposure for other local users, future processes, or forensic inspection.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The `_DEFAULTS` block includes hardcoded fallback credentials, meaning the module may silently authenticate with embedded secrets when no user configuration exists. This is risky because it hides security-sensitive behavior, encourages reliance on repository-shipped credentials, and can lead to unauthorized service access or accidental credential disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User-supplied place queries are sent directly to third-party services via HTTP requests without any warning or consent mechanism in this file. This is dangerous because sensitive or proprietary location terms embedded in metadata workflows may be disclosed externally, violating user expectations and potentially privacy or compliance requirements.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The Nominatim request forces the Accept-Language header to Chinese without user choice or clear justification. While not as severe as data exfiltration itself, this can alter returned results, leak locale assumptions, and create behavior inconsistent with user expectations or deployment requirements.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 84% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15