Geoskill: MODIS Product Search

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:16 AM UTC
• Version: 5.0.2

Overview

This is largely a MODIS lookup skill, but it embeds credential handling and adds network and file-write behavior that users should review before installing.

Install only if you are comfortable with a MODIS helper that can read local Earthdata credential sources, includes a hardcoded fallback credential, may contact third-party geocoding services for place lookup, and can write cache or QA files. Prefer a version with the hardcoded credential removed, dependency metadata fixed, remote geocoding made explicit/opt-in, and credential discovery limited to user-approved Earthdata use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill is documented as a local query tool, but the metadata and findings indicate capabilities including environment access, file I/O, network access, and shell usage without declared permissions. That creates an unnecessary trust gap: users and orchestrators cannot accurately reason about what the skill may access or do at runtime.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: There is a strong description-behavior mismatch: the skill claims to be a local MODIS product lookup tool, yet analysis indicates geocoding, generic downloading, QA sidecar writes, broader sensor registries, multi-service credential handling, and hardcoded fallback Earthdata credentials. This kind of hidden scope expansion is dangerous because it can cause users or agents to expose credentials, make network requests, or manipulate files under false assumptions about the skill's purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback Earthdata credentials directly in source, which creates an immediate secret-exposure risk and allows anyone with code access to reuse the account. In the context of a MODIS product search skill, embedding live credentials is especially unjustified because the skill should rely on user-supplied secrets or anonymous metadata access, not vendor a shared account.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: This credential helper reaches beyond the declared purpose of a local MODIS product search tool by supporting OpenAI, CMA, and EOG credentials. Broad credential access increases blast radius: a compromise or misuse of this module could expose unrelated accounts and encourages over-privileged skill behavior.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements a fully generic remote downloader with retries, resume support, hash verification, and arbitrary local file writes, which materially exceeds the stated purpose of a local MODIS product query tool. In the context of an agent skill, this creates an unnecessary capability expansion that can be abused to fetch untrusted remote content and persist it locally, increasing the attack surface for data exfiltration, payload staging, or unauthorized file placement.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The HTTP GET helper provides network access and supports streaming remote content into later file writes without any origin restrictions or use-case-specific validation. For a skill advertised as a local product search tool, this unjustified network-and-write primitive is dangerous because it can be repurposed to contact arbitrary hosts and support unauthorized downloading of attacker-controlled data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as a local query tool, but the `place` command delegates resolution to a vendored AOI component explicitly documented as using Open-Meteo and Nominatim. That introduces undeclared network dependence and causes user-supplied place names to leave the local environment, which is a real security and privacy boundary violation even if the feature is functionally useful.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A product search/query tool should not access local credentials unless strictly necessary for its core function, yet `format_download_info()` imports a credential helper and reads `EARTHDATA_USERNAME` from the environment. Even though it only uses the username for output generation, this still crosses into credential-access behavior and can expose sensitive local configuration to downstream consumers of the tool output.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The `--qa` option accepts an arbitrary filesystem path, creates parent directories, and writes a JSON sidecar there without restriction. In an agent setting, untrusted callers can use this to overwrite or plant files anywhere the process has permissions, which exceeds the expectations of a read-only local query tool.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation encourages generation of wget/curl commands using credentials from environment variables or .netrc, but it does not adequately warn that command lines, shell history, logs, or copied snippets can expose account details. In an agent setting, automatically composing credential-bearing commands materially raises the risk of credential leakage.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: The Nominatim request unconditionally sets Accept-Language to Chinese, which leaks a locale preference the user did not explicitly choose and can influence third-party responses in a way that reveals assumptions about the operator or deployment. In a tool advertised as local, silent transmission of user place queries plus forced locale to an external service increases privacy risk and makes network behavior less transparent.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded fallback credentials in source are a real secret-management failure regardless of whether they are framed as defaults. They can be harvested from the repository, reused silently at runtime, and may bypass user awareness because the module automatically falls back without clear disclosure.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: Auto-filling usernames from environment variables, local credential files, or internal credential sources into generated download commands normalizes secret-material handling and increases the chance of unintended disclosure. Even when only the username is inserted, the behavior reveals local credential state and encourages tighter coupling between the skill and host secrets than its stated purpose requires.

Credential Access

High

• Category: Privilege Escalation

Content

Resolution order (when generating download commands):

1. EARTHDATA_USERNAME env var (auto-fills --user in the generated wget)
2. ~/.netrc entry for machine urs.earthdata.nasa.gov (skill outputs cookie-jar form)
3. **Default** 
uiduobao (geoskill-core credentials.py) — auto-fills --user placeholder

• Confidence: 94% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

3. **Default** 
uiduobao (geoskill-core credentials.py) — auto-fills --user placeholder

Password is **never** auto-filled; use EARTHDATA_PASSWORD env var, .netrc,
or type it interactively. Register your own free account at
https://urs.earthdata.nasa.gov/users/new/ for heavy use.

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 81% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 80% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 85% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

lines.append("Command Line Download (wget):")
    # Phase 7 (2026-07-27): auto-fill username from vendored credentials helper
    # (if available). Password is never auto-filled for safety — user must
    # either set EARTHDATA_PASSWORD env var, configure .netrc, or type it.
    try:
        from _geoskill_core.credentials import get_earthdata_creds
        u, _p = get_earthdata_creds()

• Confidence: 96% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

modis_products

• Confidence: 93% confidence
• Finding: modis_products

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.