Security audit

geoskill-precision-farming-zoning

Security checks across malware telemetry and agentic risk

Overview

The advertised zoning workflow is mostly local, but the packaged code includes undocumented network geocoding and hardcoded service credentials, so it needs review before installation.

Install only after reviewing or removing the unused credential/geocoding helper code and rotating/removing the embedded credentials. If used as-is, assume the documented CLI can run locally, but the package also contains helpers capable of third-party place lookup and local credential discovery.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises a simple offline zoning workflow, but the detected capabilities include shell, file read/write, environment access, and network without any declared permissions or disclosure. This creates a trust and review gap: users may run the skill assuming limited local processing while it can access broader system resources, increasing the chance of unintended data exposure or command execution through the underlying implementation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is agricultural zoning, but the referenced behavior includes unrelated geocoding, generic download logic, multiple external service integrations, credential management for several providers, and even embedded fallback credentials. This mismatch materially increases risk because hidden network access and bundled credential code expand the attack surface, can exfiltrate sensitive data, and suggest code reuse beyond the stated scope, making security review and user consent unreliable.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The code sends user-supplied place queries to external services (Open-Meteo and Nominatim), but the manifest description only mentions clustering/zoning and not outbound geocoding. This creates an undisclosed data egress/privacy issue: user-provided location intent may be transmitted to third parties without clear consent or operator awareness.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The function claims to detect antimeridian-crossing bounding boxes, but its logic only flags longitudes outside [-180, 180] and misses the documented wrap-around case where coordinates remain in-range but W >= E (for example, 170 to -170). In this skill context, that can cause invalid geospatial extents to pass with misleading diagnostics or be rejected under the wrong reason, leading to incorrect area calculations, zone generation, or downstream agronomic advice for affected regions.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: The docstring states that passwords are not cached, but `load_user_secrets()` loads secrets into the module-level `_DEFAULTS` dictionary and retains them for the process lifetime. This discrepancy can cause operators to underestimate memory-residency risk and affects incident response, debugging, and threat modeling for long-lived processes.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The `get_earthdata_token()` docstring claims support for reading a token from `.netrc account <TOKEN>`, but the implementation only calls `_resolve("EARTHDATA_TOKEN")` and never parses the `account` field. This kind of security-documentation mismatch can lead users to place tokens in locations they believe are supported, causing broken auth paths and unsafe workarounds such as hardcoding tokens elsewhere.

Context-Inappropriate Capability

Medium

Confidence: 79% confidence
Finding: The module sends user-provided place names to third-party geocoding services, creating an external data egress path that is not obviously necessary from the manifest's stated precision-farming zoning purpose. In a farming context, queried locations may reveal sensitive farm sites or operational areas, and this network behavior occurs automatically with little user visibility or control.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Place names entered by users are transmitted to third-party geocoding providers without any disclosure in this file or visible consent mechanism. Because location queries can reveal sensitive interests, farm sites, or operational areas, this undisclosed data sharing presents a real privacy and compliance risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The module contains hardcoded fallback credentials (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`) directly in source. Embedded credentials are dangerous because anyone with source access can reuse them, and downstream users may unknowingly authenticate with shared secrets, enabling account abuse, attribution confusion, service suspension, or broader compromise if the same password is reused elsewhere.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scikit-learn
Confidence: 95% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scikit-learn
Confidence: 95% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scikit-learn
Confidence: 95% confidence
Finding: scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15