geoskill-precipitation-nowcasting

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:33 PM UTC
• Version: 1.0.0

Overview

The skill's main nowcasting command appears local, but the package also ships undisclosed network, credential, and provenance-risk code that does not fit the offline precipitation-nowcasting purpose.

Review before installing. The documented nowcasting workflow is local, but the package should be narrowed or clearly documented: remove unrelated credential, download, and geocoding helpers; remove and rotate the exposed Earthdata fallback credential; correct vendored provenance; and pin dependencies. Avoid using this skill in sensitive environments until those issues are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a serious description-behavior mismatch: the skill is presented as fully offline, local precipitation nowcasting, yet the finding indicates hidden support for geocoding, generic HTTP downloads, centralized credential handling, and even hardcoded fallback usernames/passwords. That combination can mislead operators into granting trust to a skill that may exfiltrate data, access remote services, or misuse embedded credentials far outside its declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the surrounding package ('geoskill-precipitation-nowcasting'), which undermines software provenance and integrity checks. This mismatch can cause reviewers or automation to trust the wrong dependency set, hide accidental code reuse, or mask a supply-chain substitution if the vendored files do not actually correspond to the declared skill context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code sends user-supplied place queries to third-party geocoding services, which creates a privacy and data-exposure risk outside the core precipitation-nowcasting function. In this skill context, AOI lookup is adjacent to the workflow, but undisclosed outbound requests can leak sensitive locations or operational interests to external services.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This module gives the nowcasting skill a generalized credential broker for multiple external services far beyond the declared precipitation-forecasting scope. Broad secret-access capability increases blast radius: if any other part of the skill is compromised or extended, it can reuse this module to access unrelated accounts and services without additional user consent.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The code explicitly supports reading OPENAI_API_KEY even though the skill description does not justify any LLM or OpenAI-compatible service access. Access to unrelated API credentials is dangerous because it enables secret harvesting and later external use outside the user’s expected workflow.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Support for FIRMS and EOG credentials appears unrelated to optical-flow precipitation nowcasting, so the module unnecessarily expands what secrets the skill can access. Even if not immediately exfiltrated here, unauthorized collection or availability probing of extra credentials creates avoidable exposure and weakens least-privilege boundaries.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The module claims passwords are not cached, but load_user_secrets() stores secret values in the process-global _DEFAULTS dictionary after first load. Retaining credentials in process memory longer than documented increases exposure to accidental leakage through debugging, memory inspection, or unintended reuse by unrelated code.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The module sends user-supplied place queries to third-party geocoding services, creating an external data-sharing path that is not clearly justified by the manifest's narrow precipitation-nowcasting description. Even if the data is only a place name, it can still expose sensitive locations or user intent to external providers and expands the skill's effective attack surface through outbound network dependence.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The geocoding requests transmit raw user-provided place queries to external providers without any disclosure mechanism in this file, which is a genuine privacy/security-quality issue. Even though the feature is functionally related to defining an AOI, queries may reveal private addresses, sensitive facilities, or mission focus to third parties.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains a hardcoded plaintext Earthdata username and password as fallback defaults. Embedded credentials are highly dangerous because anyone with source access can recover them, and any execution path that falls back to them may silently authenticate against a real external account without user awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code transmits raw user-provided place queries to external geocoding providers without any visible consent, warning, or privacy boundary. Location queries can reveal sensitive whereabouts, operational interests, or customer context, so silent transmission to third parties is a meaningful privacy and supply-chain risk.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice can leak assumptions about user region or deployment context to the third-party service and may influence returned data in unexpected ways. While not severe on its own, it is an unnecessary privacy and behavior-control issue, especially in a skill whose manifest does not disclose such locale forcing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15