geoskill-pest-disease-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:31 PM UTC
• Version: 1.0.0

Overview

The main pest-detection script is mostly local and coherent, but the package also ships undisclosed credential and network helper code, including hardcoded Earthdata credentials, that does not fit the stated offline purpose.

Review this skill before installing. The visible pest-detection entrypoint appears local, but the package includes unused or under-documented helpers that can read local credential stores, retain secrets in process memory, contact third-party geocoding services, and use embedded Earthdata credentials. Install only after removing or auditing those helpers and pinning dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises local/offline geospatial analysis, but the documented/runtime capabilities include environment access, file read/write, shell, and network without any declared permissions or explicit disclosure. This expands the trust boundary and can expose local files, secrets, or enable unexpected external communication, especially in agent environments where users rely on metadata to understand what a skill may access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims pest/disease detection, but the detected behavior includes credential harvesting sources (.env, secrets files, .netrc), hardcoded fallback Earthdata credentials, generic geocoding/network access, and a broad downloader/registry framework unrelated to the narrow stated purpose. In a security context, hidden credential handling and broad network-enabled utility code materially increase the risk of secret exposure, unauthorized access, and user deception about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive operational or geographic intent outside the local environment. In a pest/disease detection context, queried locations may reveal farm, field, or monitoring targets, creating a real privacy and data-governance risk even though the implementation is not overtly malicious.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module claims passwords are not cached, but load_user_secrets() copies secrets from ~/.geoskill/secrets.json into the module-global _DEFAULTS dictionary and retains them for the lifetime of the process. This discrepancy increases exposure in long-lived processes, memory inspection, debug dumps, or accidental reuse across components.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: External geocoding is performed without any user-facing warning in this file, so users may unknowingly transmit sensitive place queries to third parties. In an agricultural monitoring skill, location names can be commercially sensitive or privacy-relevant, making silent network disclosure a meaningful security/privacy weakness.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: Forcing the `Accept-Language` header to `zh-CN,zh;q=0.9` without user opt-in leaks an implicit locale preference and may influence third-party processing in ways the user did not request. This is a minor privacy and transparency issue rather than a severe exploit path, but it is still a real concern when interacting with external services.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The Nominatim request unconditionally sets Accept-Language to zh-CN, which can alter results without user awareness and may disclose regional assumptions or produce biased geocoding behavior. While not a critical exploit primitive, it is an unjustified hard-coded request preference that can cause incorrect AOI resolution and unexpected data handling behavior.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 100% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15