Geoskill: NASA Dataset Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:05 AM UTC
• Version: 5.0.1

Overview

This NASA data downloader has a coherent purpose, but it ships and can silently use hardcoded Earthdata credentials, so it needs review before installation.

Review this skill before installing. Use only your own Earthdata token via environment variables or a protected secret store, avoid relying on the bundled fallback account, do not copy the sample password/token, and be careful with --qa outputs because they can preserve query details and credential-state metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is narrowly scoped to NASA dataset search/download, but the static finding indicates materially broader functionality including hardcoded default credentials, arbitrary downloading, geocoding, and unrelated dataset registries. That mismatch is dangerous because it can conceal credential use and generalized network/file capabilities beyond user expectations, reducing informed consent and increasing abuse potential.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs users to place long-lived Earthdata credentials, including password and bearer token, in a local secrets file. While credential storage is expected for authenticated downloads, encouraging plaintext local storage without stronger guidance increases the risk of credential theft from disk, backups, logs, or over-broad file access by other tools.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code sends user-provided place queries to third-party geocoding services unrelated to NASA, which creates an undisclosed data egress path. In a skill presented as a NASA downloader, users may reasonably expect requests to go only to NASA/Earthdata, so place names can be unintentionally disclosed to external providers.

Intent-Code Divergence

High

• Confidence: 89% confidence
• Finding: Network failures are swallowed and converted into empty results, causing the caller to receive NoMatchError instead of a network-specific failure. This can mislead automation into treating transient connectivity or upstream blocking as a legitimate 'no results' condition, potentially driving unsafe fallback behavior or incorrect operational decisions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example shows realistic plaintext credentials, including a visible username, password, and bearer token format, without an explicit warning that the values are placeholders only. This normalizes unsafe handling of secrets and can lead users to copy the pattern directly into files that may be exposed through source control, shared machines, or support artifacts.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: User-entered location queries are transmitted to Open-Meteo and Nominatim without any in-code disclosure or consent mechanism. Even if the data seems low sensitivity, location intent can reveal research targets, operational interests, or personal activity, making silent exfiltration to third parties a privacy and trust issue.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Resolved place data is written to a persistent cache under the user's home directory without explicit notice or consent. This can leave a local history of queried locations that may be accessible to other local users, backup systems, or forensic tooling, creating avoidable privacy exposure.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: Forcing the Nominatim Accept-Language header to Chinese without user opt-in changes request metadata in a way the user did not request and may affect returned content and fingerprinting. While not severe on its own, it is unnecessary data shaping and can undermine user expectations, especially in a globally targeted tool.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback Earthdata username and password in source code. Embedded credentials are a real secret-management failure: anyone with code access can recover and abuse them, and the skill will silently authenticate with shared credentials when no user-supplied secret is present.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The QA sidecar writes all invocation arguments plus the output of describe_credentials() to a JSON file. Even if raw secrets are not directly serialized, this creates a plaintext audit artifact that can reveal credential availability, source locations, output paths, query parameters, and other potentially sensitive operational details, which is an information disclosure risk if the file is readable by other users or collected into logs.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Session Persistence

Medium

• Category: Rogue Agent

Content

## Common options (per subcommand)

- `--format {text,json}` — output format
- `--qa PATH` — write a JSON run-summary sidecar to `PATH` (mirrors Phase 5 convention)
- `--bbox W S E N` — geographic bounding box in WGS84
- `--temporal-start YYYY-MM-DD` / `--temporal-end YYYY-MM-DD` — date range (inclusive)
- `--count N` — max results

• Confidence: 72% confidence
• Finding: write a JSON run-summary sidecar to `PATH` (mirrors Phase 5 convention) - `--bbox W S E N` — geographic bounding box in WGS84 - `--temporal-start YYYY-MM-DD` / `--temporal-end YYYY-MM-DD` — date range

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.