geoskill-pca-dimension-reduction

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:29 PM UTC
• Version: 1.0.0

Overview

The PCA skill’s main workflow is local raster processing, but the package includes under-disclosed network, credential, cache, and downloader code that does not fit the advertised offline purpose.

Review this before installing. Ask the publisher to remove or clearly document the geocoding, downloader, cache, and credential modules, delete and rotate the hardcoded Earthdata password, and require explicit opt-in for any network or credential use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documentation declares a simple offline PCA workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions or user-facing disclosure. This is dangerous because it expands the trust boundary silently: users may run the skill believing it only performs local numeric processing while it can access credentials, invoke commands, or communicate externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: a PCA raster-processing skill reportedly also performs online geocoding, caching, HTTP downloading, credential loading from environment/.netrc/secrets, and even includes hardcoded Earthdata credentials. Such hidden functionality is dangerous because it can exfiltrate data, use sensitive local credentials, and access remote resources far beyond the stated purpose, violating least privilege and undermining informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored core metadata claims the embedded core belongs to a different skill ('landsat-download') than the published PCA dimension-reduction skill. This kind of identity mismatch breaks provenance and integrity expectations, making it harder to verify that the included core code is the code reviewers intended, and could conceal accidental or unauthorized code reuse across skills.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file adds AOI geocoding, network access, and caching capabilities that are materially broader than a PCA dimension-reduction skill needs. Scope expansion is dangerous because it increases attack surface and causes user inputs to be processed and potentially transmitted or persisted in ways the skill description does not disclose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code sends user-provided place names to external geocoding services (Open-Meteo and Nominatim), creating undisclosed outbound data flow and dependency on third-party services. In the context of a PCA processing skill, this is an unnecessary capability expansion that can leak potentially sensitive locations and violate least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Defining a persistent cache under the user's home directory introduces local state retention unrelated to PCA transformation and can store sensitive place queries across runs. This broadens the skill's behavior beyond its stated purpose and may surprise users or expose prior inputs to other local processes or users with filesystem access.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The cache read/write code persists AOI query results to local files, which is functionality outside the declared PCA result generation workflow. While not code execution, it creates an unnecessary data-retention surface and hidden filesystem side effects that can expose sensitive geographic inputs.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The module-level documentation claims the checks are mandatory and enforced before outputs are written, but the implementation only returns issue lists and does not enforce failures or verify the projected-CRS area requirement. In a geospatial processing skill, this can cause downstream consumers to trust scientifically invalid outputs, enabling integrity failures, silent mismeasurement, and bad decisions based on incorrect spatial products.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module implements broad credential access and management for multiple third-party services that are unrelated to a PCA-only geospatial transform skill. In the context of a local image-processing skill, adding centralized access to environment variables, ~/.netrc, and user secret files materially expands the blast radius: any downstream code importing this module can retrieve sensitive credentials without an obvious user action.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads secrets from environment variables, a user-home secrets file, and .netrc, which constitutes credential harvesting capability from multiple local trust stores. For a PCA dimension-reduction skill that should operate on provided raster inputs, this is disproportionate and creates a strong opportunity for misuse or accidental exfiltration by any imported component.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Including OpenAI API key handling in a PCA image-processing skill introduces unnecessary access to an unrelated secret. Even if unused in this file, exposing a helper for retrieving model-service credentials widens the attack surface and suggests the skill could access external AI services outside its declared purpose.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file introduces a reusable network download primitive into a skill described only as PCA-based raster dimensionality reduction, which materially expands the skill's capability beyond its declared purpose. In agent environments, unjustified download functionality can enable retrieval of untrusted remote data or payloads, increasing the risk of data exfiltration paths, supply-chain abuse, and unexpected external communications.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The `_http_get` implementation provides generic outbound HTTP(S) fetching for arbitrary URLs, and nothing in this module restricts destination, scheme, or content type. In the context of a PCA transformation skill, this is an unnecessary capability escalation that could be abused to contact attacker-controlled servers, fetch malicious inputs, or bypass expectations that the skill operates only on local imagery.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file adds a full place-name geocoding feature with external API access, but the declared skill purpose is PCA-based raster dimension reduction. That mismatch materially expands the skill’s capabilities and data flows beyond user expectations, increasing the risk of covert data exfiltration, unexpected network use, and supply-chain abuse through a seemingly unrelated helper module.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The legacy fallback contains direct network geocoding requests to third-party services, which are not justified by a PCA image-processing skill. Hidden or unnecessary outbound requests are dangerous because user-provided place names and execution context can be transmitted externally without clear necessity, violating least privilege and making the module a plausible exfiltration path.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Geocoding requests transmit user-supplied place queries to external services without any evident disclosure or consent handling in this file. Place names can be sensitive operational or personal information, so silent exfiltration to third parties is a real privacy and security concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes resolved queries to a persistent cache in the user's home directory without explicit disclosure, creating covert data retention. Even if the cached data is not highly privileged, storing location-related queries can reveal user interests, projects, or sensitive areas of work.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Hardcoded secrets in source code are inherently unsafe because they can be extracted by anyone with code access, reused unintentionally across environments, and silently authenticate outbound requests without user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The Nominatim request forces the Accept-Language header to Chinese regardless of user preference or documented need. This can alter returned data unexpectedly, leak inferred regional assumptions, and is especially suspicious in a skill whose stated function is unrelated to geocoding or localization.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The code sends user-supplied place queries to the Open-Meteo geocoding API without any visible disclosure or consent mechanism in this module. While place names are often low-sensitivity, transmitting user input to third parties without transparency creates a privacy and compliance risk, particularly when the skill’s advertised purpose does not suggest network geocoding.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The fallback Nominatim request also transmits user-provided place queries externally without explicit disclosure in the skill interface. Because this occurs in a fallback path, users may be even less aware that their input is being sent to another provider, compounding transparency and privacy concerns.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 94% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 93% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15