geoskill-object-detection-yolo

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:29 PM UTC
• Version: 1.0.0

Overview

The advertised detector is mostly local, but the package ships undisclosed network, cache, and credential-handling helpers unrelated to the offline/no-upload description.

Treat this as a package that needs review before installation. The detector entrypoint appears to work locally, but install or run it only in an isolated environment without valuable credentials, or remove the unrelated vendored geocoding, download, and credential modules before use. Do not rely on the offline/no-upload statement unless those helpers are removed or clearly disabled and documented.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises an offline local image-processing workflow, yet the analyzed capabilities indicate access to environment variables, file I/O, shell execution, and network. That gap creates an unnecessary trust boundary expansion: a user may run the skill expecting only local numeric processing while it can access secrets and external systems. In a security review, undeclared sensitive capabilities are dangerous because they can enable data exfiltration or unintended system interaction without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a substantial description-behavior mismatch: the skill claims to be an offline numpy-equivalent detector, but the finding indicates credential parsing, secret discovery in common locations, network downloading, geocoding service calls, and broader utility modules unrelated to the stated purpose. Such hidden functionality is high risk because it can silently collect credentials or transmit data externally under the cover of a benign offline analytics tool. The offline/geospatial context makes this more dangerous because users are specifically reassured that no network or upload occurs.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the advertised object-detection skill. This is a supply-chain integrity problem because it undermines provenance, makes review and auditing unreliable, and can hide accidental or intentional inclusion of the wrong dependency set. In this context, the mismatch is more suspicious because the file is specifically intended to attest what code was vendored, so incorrect identity metadata defeats that trust function.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The module advertises an offline-first AOI helper yet includes online geocoding fallbacks and persistent file caching under the user's home directory. In the context of a skill described as offline object detection, this creates an unexpected network and local data persistence behavior that can leak user-supplied location queries and violate deployment assumptions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-provided place names to external services (Open-Meteo and Nominatim), which is unrelated to the stated offline numpy-equivalent object-detection purpose. This can exfiltrate sensitive AOI/location inputs to third parties and break offline or restricted-environment guarantees that users may rely on.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module defines a persistent cache directory in the user's home folder for AOI results, which is unnecessary for an allegedly offline object-detection skill and causes location-derived data to remain on disk. Persistent caching increases privacy risk because queried places may be recoverable later by other local users, processes, or forensic inspection.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The docstring claims ambiguous results are returned as candidates without silently choosing the first, but `resolve_place` sorts candidates and automatically selects one before returning ambiguity metadata. This mismatch can cause silent misresolution of a place name, leading downstream processing to operate on the wrong geographic area without the user realizing it.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module materially expands the skill’s capability from an offline object-detection/geocoding tool into a credential broker for multiple online services, including Earthdata, FIRMS, CMA, EOG, and OpenAI. In the context of a skill explicitly described as offline, broad credential-access code is dangerous because it creates unnecessary access to sensitive secrets and enlarges the attack surface for downstream exfiltration or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Providing a helper to read OPENAI_API_KEY is not aligned with an offline geospatial detection skill and gives the code access to an unrelated high-value secret. Even without immediate exfiltration in this file, unnecessary secret access is risky because any later code path can use that token to contact external services or incur cost.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code advertises and implements retrieval of several remote-service credentials despite the skill being positioned as offline. This mismatch is dangerous because it normalizes broad secret harvesting from the environment, .netrc, and user secret files for services unrelated to the claimed task.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation claims passwords are not cached, but load_user_secrets() mutates _DEFAULTS and retains secrets in process memory after first load. This inconsistency is security-relevant because operators may rely on the documented behavior and underestimate exposure in long-lived processes, debugging sessions, dumps, or introspection.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The module introduces a generic HTTP downloader with local file write capability, which is materially inconsistent with the declared purpose of an offline NumPy-equivalent object-detection/geocoding skill. In a skill expected to be offline, hidden network and persistence behavior expands the attack surface for unauthorized payload retrieval, data exfiltration, or silent environment modification, especially if higher-level code can supply arbitrary URLs and destination paths.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code adds full HTTP GET capability with optional resume support, which is unjustified by the stated offline skill purpose and can be abused to fetch untrusted remote content into the local filesystem. That mismatch is dangerous because it creates a covert capability not reasonably expected by users or reviewers, increasing the chance that downstream code will use it to stage malicious models, data, or configuration files.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The exported resolve_place API exposes geocoding behavior that is inconsistent with the skill’s declared purpose of offline object detection. In a skill marketed as offline, hidden or undocumented network-capable functionality can cause unanticipated data egress and expands the attack surface beyond what users and operators expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This code performs live HTTP requests to external geocoding services despite the skill description claiming an offline numpy-equivalent implementation. Such undisclosed outbound requests can leak user-supplied place names and metadata, violate offline or restricted-environment assumptions, and introduce dependency on third-party services.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The legacy resolver adds a substantial geocoding capability unrelated to the stated object-detection function, including query normalization, candidate ranking, and optional fallback to Nominatim. In the context of an offline detection skill, this is dangerous because it constitutes hidden functionality that can exfiltrate user input and bypass operator expectations about what the skill is allowed to do.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The module docstring advertises AOI/place compatibility and migration logic that conflicts with the package’s stated object-detection intent. While a docstring alone is not exploit code, this mismatch is a strong indicator of repurposed or mislabeled functionality, which increases the risk of unsafe hidden behavior and operator misunderstanding.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Location queries are transmitted to third-party geocoding services without any user-facing warning in this module, creating an undisclosed privacy exposure. Even if the data is only a place name, AOI lookups can reveal user interests, project targets, or operational locations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists geocoding results to a cache directory under the user's home directory without clear disclosure or retention controls. Storing AOI query artifacts on disk can expose sensitive location history beyond the current run and is especially problematic when users expect an offline, self-contained processing skill.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials with a real-looking username and password. Hardcoded secrets are dangerous because they may expose a real account, encourage silent unauthorized access when users have not configured credentials, and can be extracted from source, logs, packages, or memory by anyone with code access.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 95% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 95% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 95% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 94% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15