Geoskill: MODIS Lst Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:13 AM UTC
• Version: 5.0.1

Overview

The skill mostly matches its MODIS download purpose, but it silently includes and can use shared hardcoded Earthdata credentials, which users should review before installing.

Install only after removing or disabling the embedded Earthdata fallback credentials, rotating any exposed account if it is real, and confirming the skill will use only credentials you explicitly provide. Prefer a dedicated NASA Earthdata account/token, review any use of .netrc or local config files, and avoid using --place for sensitive locations unless you are comfortable sending those place names to external geocoding services.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function documentation explicitly claims an ellipsoidal area calculation with correction, but the implementation uses a simple spherical trapezoid formula with radius WGS84_A only. In a geospatial validation module, this mismatch can cause downstream scientific or compliance decisions to rely on materially inaccurate area values, especially for large extents or higher latitudes, while users are misled into believing the computation is more accurate than it is.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation claims passwords are not hardcoded in source, but the file embeds fallback credentials directly in `_DEFAULTS`. This is dangerous because anyone with source access can recover and reuse the credentials, and the misleading documentation may cause reviewers to underestimate the exposure.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The comments say these credentials must not appear in skill source, yet the code defines them inline. This contradiction increases risk because it normalizes a prohibited practice and conceals a real secret exposure behind reassuring comments.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The docstring describes fallback behavior including a local path and default-account handling that is not implemented in this file and explicitly references shared default credentials supplied elsewhere. Misleading credential-loading documentation can cause operators to rely on insecure assumptions, and the mention of default credentials normalizes unsafe authentication practices that could lead to unauthorized account reuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to place Earthdata credentials in environment variables and to pass usernames on the command line, but it does not warn about common secret-handling risks such as process inheritance, shell history leakage, CI/CD log exposure, or accidental persistence in scripts. In this context the issue is not overtly malicious, but it can lead to credential disclosure when users copy the examples into shared terminals, automation, or GitHub Actions workflows.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The module sends user-supplied place queries to third-party geocoding services and also persists resolved queries to a file cache under the user's home directory without any consent or prominent disclosure in this file. In a skill context, place names can be sensitive operational or personal location data, so silent network transmission and local persistence can leak private information to external services or other local users/processes.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: The code unconditionally sets Accept-Language to zh-CN for Nominatim requests, which reveals a locale preference to the remote service without user choice and may influence results in ways the caller did not intend. This is primarily a privacy and transparency issue rather than a direct code-execution risk, but in some deployments locale leakage can still be sensitive metadata.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code contains hardcoded fallback credentials that will be silently used when environment variables or user secrets are absent. Silent fallback to embedded secrets is dangerous because it can trigger unauthorized account use without operator awareness and makes accidental credential leakage much more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When HARDCODED_BBOXES and aliases do not match, the code transmits the raw user-supplied place query to the external Nominatim service. In agent or enterprise contexts, place names may reveal sensitive user intent, operational locations, or internal investigations, so this creates a privacy and data-exposure risk even though no code execution occurs.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: When hardcoded resolution fails, the function may send the user-provided place string to an online geocoder via the vendored core with `allow_nominatim=True`. If callers pass sensitive, internal, or user-identifying location text, this causes undisclosed third-party data disclosure and potential privacy/compliance issues, especially because the default behavior enables the network fallback automatically.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The embedded commentary explicitly references fallback to default Earthdata credentials provided elsewhere, which is a serious anti-pattern. Shared or hardcoded default credentials can enable unauthorized access, accidental credential sharing across users, and make compromise broadly reusable if those credentials are ever active.

Credential Access

High

• Category: Privilege Escalation

Content

pass

def get_earthdata_creds():
    """Get Earthdata credentials from env / .netrc / geoskill-core default.

    Phase 7 (2026-07-27): 优先用 vendored geoskill_core.credentials 统一解析
    (env > .netrc > 默认), 若返回空则降级到本地的 ~/.modis_lst/config.json。

• Confidence: 75% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"""Get Earthdata credentials from env / .netrc / geoskill-core default.

    Phase 7 (2026-07-27): 优先用 vendored geoskill_core.credentials 统一解析
    (env > .netrc > 默认), 若返回空则降级到本地的 ~/.modis_lst/config.json。
    默认账号 (ruiduobao / Ruiduobao123) 由 geoskill-core 提供, 不在本文件。
    """
    try:

• Confidence: 97% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

modis_lst_download
requests>=2.28.0
tqdm>=4.64.0

• Confidence: 90% confidence
• Finding: modis_lst_download

Unpinned Dependencies

Low

• Category: Supply Chain

Content

modis_lst_download
requests>=2.28.0
tqdm>=4.64.0

• Confidence: 97% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

modis_lst_download
requests>=2.28.0
tqdm>=4.64.0

• Confidence: 88% confidence
• Finding: tqdm>=4.64.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: requests==2.28.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: tqdm==4.64.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_modis-lst-download.py:26

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_qa_flag.py:25