geoskill-pasture-quality-assessment

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:27 PM UTC
• Version: 1.0.0

Overview

The main pasture-analysis tool is local, but the package also ships under-disclosed credential and network helper code, including hardcoded Earthdata credentials.

Review this skill before installing. The pasture-analysis entrypoint itself appears local and purpose-aligned, but the package should remove hardcoded credentials, drop unrelated credential providers, and clearly disclose or disable network geocoding and home-directory caches unless the user explicitly opts in.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation declares no permissions, yet the described execution model and referenced script imply access to shell, filesystem, environment, and potentially networked resources. This creates a trust and transparency gap: users or orchestrators may approve or sandbox the skill incorrectly, enabling broader access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is narrow pasture-quality assessment, but the analyzed behavior indicates much broader capabilities including network geocoding, AOI caching, generic HTTP download logic, external credential management, and even built-in default NASA Earthdata credential fallback. Hidden or undocumented functionality is dangerous because it can exfiltrate data, fetch untrusted content, or misuse embedded credentials under the guise of a benign geospatial workflow.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This credential manager exposes access paths for multiple unrelated third-party services (OpenAI, CMA, EOG, FIRMS, Earthdata) inside a pasture-quality skill component. Broad credential brokerage increases the blast radius: any code in the skill/runtime importing this module can probe for or use secrets unrelated to the stated skill purpose, violating least privilege and enabling unintended external access.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: Support for OPENAI_API_KEY is present even though the skill description does not justify LLM/provider access for pasture assessment. Unnecessary credential-access code creates an exfiltration and misuse path if any part of the skill or agent can invoke get_openai_key() and send data or consume paid API resources.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The module hardcodes fallback Earthdata credentials directly in source code. Hardcoded secrets are immediately sensitive because anyone with repository or package access can reuse them, and any consuming code automatically gains account access even when the user did not provide credentials.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documentation says passwords are not cached, but load_user_secrets() copies secret values into the module-global _DEFAULTS dict and retains them for the life of the process. This misleading behavior can cause operators to underestimate in-memory secret exposure in long-lived agent processes.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Place queries entered by the user are transmitted to third-party geocoding services without any notice or consent mechanism in this file. Even if the data seems low sensitivity, user-supplied locations can reveal farms, properties, or operational areas, creating a meaningful privacy leakage to external providers.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: Resolved place data is persisted under the user's home directory without an explicit warning or consent path. Cached AOI manifests may reveal user interests or sensitive locations over time, especially on shared systems or managed environments where home-directory contents are accessible to other local actors or backups.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The code silently falls back to hardcoded credentials and loaded user secrets without any user-facing disclosure. In an agent skill context, hidden credential use is dangerous because the skill may authenticate to external services unexpectedly, masking account use, data-access scope, and billing exposure from the operator.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15