Geoskill: Phenology Metrics

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:12 AM UTC
• Version: 5.0.1

Overview

The skill is a real phenology-analysis tool, but it bundles hardcoded Earthdata credentials and has under-disclosed network/place-resolution behavior despite local-only privacy claims.

Review carefully before installing. The core CSV/GeoTIFF phenology functionality appears purpose-aligned, but users should not rely on the local-only privacy statements for all commands. Avoid using from-place for sensitive locations unless you accept third-party geocoding/download traffic, and do not use the package until the embedded Earthdata credentials are removed and rotated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly promises that passwords are not hardcoded in source, yet `_DEFAULTS` contains a live Earthdata username and password. Hardcoded credentials are a real secret-management flaw because anyone with code access can recover and reuse them, and the misleading documentation increases the chance maintainers overlook the exposure.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file-level privacy disclosure states that processing is local-only and that no data is sent to external servers, but the later from-place workflow performs remote place resolution and scene fetching. This kind of misleading privacy claim can cause users to expose sensitive place names, AOIs, or usage patterns under false assumptions, which is a real security/privacy issue even if no explicit exfiltration logic is present.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The from-place command extends a local phenology tool into a workflow that performs external place resolution, remote data acquisition, path discovery, and subprocess orchestration. In a skill that presents itself mainly as a local analytics utility, these added capabilities increase attack surface and make unintended data disclosure or misuse more likely, especially when combined with weak disclosure and dead/unreachable code.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive location intent to external operators. In an agent skill context, users may reasonably expect local processing, especially because the module advertises 'offline first', so silent network fallback increases privacy risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The module persists resolved queries to a cache under the user's home directory without visible notice, which can leave a local history of searched places. For an agent skill handling potentially sensitive locations, this creates a privacy exposure to other local users, backup systems, or later forensic access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module includes hardcoded fallback credentials for Earthdata, meaning the package can authenticate with a bundled account even when the operator has not configured their own secrets. This is dangerous because it hides credential use from the user, enables credential leakage through source distribution, and can cause unauthorized or shared-account access across installations.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The from-place workflow can send user-supplied place information to external resolvers and invoke a downloader despite the file claiming no external transmission, and it provides no prominent warning at the command interface. This creates a meaningful privacy risk because users may unknowingly disclose sensitive locations, study areas, or operational intent to third parties.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

• Confidence: 90% confidence
• Finding: numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

• Confidence: 90% confidence
• Finding: pandas>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

• Confidence: 90% confidence
• Finding: scipy>=1.7.0

Known Vulnerable Dependency: scipy==1.7.0 — 2 advisory(ies): CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy); CVE-2023-29824 (** DISPUTED ** A use-after-free issue was discovered in Py_FindObjects() functio)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: scipy==1.7.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/phenology-metrics.py:553

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_phenology-metrics.py:18