Security audit
Security checks across malware telemetry and agentic risk
The main routing command appears local, but the package includes under-disclosed network, download, and credential-handling code that does not fit the advertised offline routing purpose.
Review before installing. The routing command itself appears to operate on local files, but the package includes extra helpers that can contact external services, download URLs, cache results, and read local credential stores if used. Install only if you are comfortable auditing or removing those unused modules and pinning dependencies.
}
# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
"urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
"firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。 # Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。 USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json" # 是否已加载过用户级 secrets（避免每次调用都重读） _user_secrets_loaded = False
def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy geopandas
numpy rasterio scipy geopandas shapely
numpy rasterio scipy geopandas shapely
numpy rasterio scipy geopandas shapely
rasterio scipy geopandas shapely
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution