geoskill-parking-lot-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:29 PM UTC
• Version: 1.0.0

Overview

The visible parking-lot tool is local, but the package also includes unrelated credential, geocoding, downloader code and a hardcoded password that are not disclosed to users.

Review this package before installing. The documented detector appears to run locally, but the package should remove or clearly disclose the unused geocoding, downloader, and credential modules, delete and rotate the hardcoded Earthdata password, and correct the vendored-core provenance metadata. Avoid using the bundled _place or _geoskill_core.credentials helpers unless you explicitly accept their network and credential-store behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill documentation declares a simple offline geospatial detection capability, yet the static analyzer detected file, shell, environment, network, and write capabilities without corresponding permission declarations. That mismatch weakens trust boundaries and can allow the skill to access local data, invoke commands, or make network requests beyond user expectations, increasing the chance of abuse or accidental exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a severe description-behavior mismatch: a parking-lot detection skill reportedly includes unrelated network geocoding, downloader logic, remote-service credential handling, and even hardcoded fallback credentials. That combination strongly suggests hidden functionality and creates substantial risk of credential leakage, covert data exfiltration, or unauthorized access to third-party services under the guise of a benign geospatial workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored core metadata claims the embedded core belongs to a different skill ('landsat-download') than the package being reviewed ('geoskill-parking-lot-detection'). This creates a supply-chain integrity problem: reviewers, tooling, or deployment logic may trust or load mismatched components, masking unintended functionality or causing the wrong vendored code lineage to be accepted as legitimate.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module performs outbound geocoding requests and persists query results to a local cache directory, which extends beyond the stated parking-lot detection purpose and can expose user-supplied place names to third-party services. In a geospatial skill, AOI resolution can be legitimate support functionality, but doing it without clear scope limitation and opt-in disclosure creates avoidable privacy and data-handling risk.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This module centralizes access to a wide range of credentials, including OpenAI, CMA, EOG, FIRMS, and Earthdata, which is far broader than the declared parking-lot detection behavior. In the context of a narrowly scoped geospatial skill, this creates unnecessary privilege and materially increases the blast radius if the skill or a dependent component is abused to harvest or misuse secrets.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code actively reads sensitive material from environment variables, a user home-directory secrets file, and .netrc, enabling broad credential discovery from the host system. For a parking-lot detection skill, this behavior is disproportionate and dangerous because it can expose unrelated account secrets that users may not expect the skill to touch.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements generic place-resolution and external geocoding logic even though the skill is described as parking-lot detection based on imagery features. This capability broadening is risky because it introduces outbound data flows and behavior not aligned with the declared skill purpose, increasing the chance of hidden data exfiltration, privacy issues, or unauthorized network dependency in environments that expect local geospatial analysis only.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and Nominatim), creating an external data disclosure channel unrelated to the stated parking-lot detection function. In a skill ecosystem, undeclared outbound requests are dangerous because they can leak sensitive locations, create supply-chain/network trust issues, and bypass expectations that analysis is performed locally or within approved services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided place queries are transmitted to external geocoding providers without any in-file user-facing disclosure or consent mechanism. Place names may contain sensitive operational or personal location information, so silent exfiltration to third parties is a meaningful privacy and compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Forcing the Accept-Language header to Chinese without user opt-in can disclose locale assumptions and influence third-party processing in a way the user did not request. This is not typically critical, but it is a privacy and transparency issue and may produce unexpected or biased results for non-Chinese users.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Embedding live or plausible credentials in source code is highly dangerous because anyone with code access can recover and reuse them, and the skill context makes this especially suspicious since such secrets are unrelated to the manifest’s limited parking-lot detection purpose.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing the Accept-Language header to zh-CN/zh without user choice can alter returned geocoding results and disclose locale assumptions about the operator or deployment. While less severe than the outbound geocoding itself, it is still problematic because it creates unexpected behavior, can bias resolution outcomes, and may conflict with user privacy or policy requirements.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 95% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 95% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 95% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 98% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 98% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 92% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 96% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 94% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15