Geoskill: NASA Dataset Catalog

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:08 AM UTC
• Version: 5.0.1

Overview

The skill is mostly a NASA dataset CLI, but it includes real-looking hardcoded Earthdata credentials and broader credential handling than the stated purpose needs.

Review this before installing. Use your own Earthdata token through environment variables or a scoped secrets file, remove or rotate the embedded sample/default credentials, and avoid sharing QA sidecar files because they may reveal credential-source metadata. The main CLI does not show destructive or exfiltration behavior, but the credential surface is broader than the skill's NASA catalog purpose requires.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that read environment variables and local credential files, write output files, invoke shell commands, and access the network, yet no explicit permission declaration is present. This increases the chance that a user or platform grants the skill broader access than expected, especially because it also handles bearer tokens and file outputs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior extends beyond a narrowly scoped NASA dataset tool and includes generic credential handling for unrelated services plus references to fallback defaults, which materially broadens the trust boundary. Most concerning, the description indicates hardcoded fallback credentials and unrelated secret ingestion paths, creating a risk of hidden data access, credential misuse, or accidental exfiltration under a benign-seeming skill label.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Credential resolution includes unrelated third-party secrets such as OpenAI, CMA, FIRMS, and EOG even though the skill is presented as a NASA catalog utility. Expanding secret lookup in this way violates least privilege and raises the risk that unrelated tokens are exposed to the skill runtime or accidentally transmitted through shared helper code.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code persistently writes geocoding query results into a cache directory under the user’s home folder without explicit disclosure or opt-in. While the cached data is not highly sensitive by itself, user-entered place names can reveal interests, locations, or research targets, and persistent storage increases privacy and data-retention risk on shared or managed systems.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring says passwords are not cached, but load_user_secrets() copies secrets from the user file into the process-global _DEFAULTS dict and reuses them for later calls. This creates long-lived in-memory retention of sensitive material and can mislead reviewers or operators into believing secrets are only fetched transiently.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The documentation includes a plaintext secrets example containing what appears to be a real username and password rather than obvious placeholders. This encourages unsafe secret handling, risks accidental credential reuse by users, and may itself expose valid credentials if copied from a real environment.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module performs outbound geocoding requests and persists cache data without any user-facing disclosure in the code path. In a dataset catalog skill, users may reasonably expect search and download functionality, but may not expect their raw place queries to be sent to third-party geocoding services or written to disk, creating privacy and compliance concerns.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The Nominatim fallback sends user-supplied place names to an external third-party service without explicit user warning or consent. Those place strings may contain sensitive project locations, operational areas, or personal locations, so undisclosed transmission can create privacy, policy, or data-governance issues even if the feature is functionally relevant.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module embeds a real-looking fallback username and password directly in source code. Hardcoded credentials are dangerous because anyone with source access can recover them, they may be reused elsewhere, and the skill can silently authenticate with an unintended account in any environment where explicit credentials are absent.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The QA sidecar unconditionally records credential-state metadata via describe_credentials() whenever --qa is used, without an explicit warning or opt-in specifically for security-sensitive metadata. Even if plaintext secrets are not written, source, availability, and related metadata can reveal authentication posture and local secret locations that may aid follow-on attacks or leak operational details when sidecars are shared.

Credential Access

High

• Category: Privilege Escalation

Content

`EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` / `CMA_API_KEY` /
   `EOG_USERNAME` / `EOG_PASSWORD`)
2. `~/.geoskill/secrets.json` (user-level, **not** vendored into the skill)
3. `~/.netrc` entries
4. Skill defaults (geoskill-core `_DEFAULTS`)

For a one-time setup, write to `~/.geoskill/secrets.json`:

• Confidence: 94% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.