geoskill-monsoon-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:06 PM UTC
• Version: 1.0.0

Overview

The main monsoon tool is mostly local, but the package includes under-disclosed credential, network, provenance, and data-integrity issues that need review before installation.

Review this package before installing in a sensitive environment. The main CLI appears to run local monsoon analysis, but the package should remove or clearly disclose unused credential/network helpers, remove hardcoded credentials, fix vendored provenance metadata, pin dependencies, and avoid producing real-looking precipitation metrics from synthetic placeholder precipitation in real-input mode.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet the content indicates capabilities for environment access, file read/write, shell execution, and possible networking. Even though the prose claims offline/local behavior, these undeclared capabilities expand the attack surface and can enable unexpected access to local secrets, filesystem data, or external endpoints if the underlying implementation exposes them.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: a monsoon-analysis skill should not need generalized credential harvesting, hardcoded Earthdata credentials, external geocoding/services, or a broad downloader/registry unrelated to its stated purpose. Such hidden functionality can expose secrets, trigger unauthorized network access, and mask supply-chain style abuse because users would reasonably trust the skill as a narrow offline scientific tool.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The vendored metadata claims the embedded core belongs to the skill 'landsat-download' while this package is presented as a monsoon-analysis skill. That mismatch is a software supply-chain integrity problem: it can indicate copied or mispackaged dependencies, broken provenance, or intentional substitution of code under misleading metadata, which undermines review and trust in the bundled component.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This helper expands the skill’s effective capabilities by sending user-provided place names to external geocoding services and persisting results in a local cache under the user’s home directory. In a monsoon-analysis skill, that creates undeclared data egress and local statefulness that users may not expect, which is a genuine security/privacy issue even if the code is not overtly malicious.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module sends user-supplied place names to external third-party geocoding services, creating an outbound data-flow capability that is not apparent from the skill's monsoon-analysis description. This can leak sensitive user queries, enable unexpected network access in constrained environments, and expand the trust boundary to external providers without explicit disclosure or consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: In input mode, the skill advertises precipitation concentration and onset/retreat analysis but does not ingest real precipitation data; instead it fabricates constant monthly precipitation and uniform daily precipitation. This can produce authoritative-looking but false outputs, creating silent integrity failure and potentially driving downstream scientific, operational, or policy decisions based on invented data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits raw user-supplied place queries to Open-Meteo and potentially Nominatim without any warning, consent flow, or minimization. Place names can contain sensitive locations such as home addresses, workplaces, or internal site names, so silent third-party disclosure is a real privacy and policy concern in this skill context.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The module contains hardcoded fallback credentials for EARTHDATA_USERNAME and EARTHDATA_PASSWORD, which means anyone running the skill without explicit configuration may silently use embedded shared credentials. Hardcoded secrets are highly dangerous because they can be harvested from source code, reused by unauthorized parties, and cause account compromise or abuse of external services.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 95% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15