geoskill-public-health-spatial

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:32 PM UTC
• Version: 1.0.0

Overview

The main tool looks like a local public-health spatial analyzer, but the package also ships under-disclosed network, credential, and caching helpers including a hardcoded Earthdata password fallback.

Review this skill before installing. The documented CLI appears local and purpose-aligned, but the package should remove the hardcoded Earthdata credential, disclose or remove the network geocoding and download helpers, document any local cache files, and pin dependencies before it is treated as a low-risk offline public-health analysis skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation declares no permissions, yet the detected capabilities include shell, file read/write, environment access, network, and broader code execution behavior. This creates a transparency and trust failure: users may invoke the skill expecting an offline local analysis tool while it can access sensitive local resources or external services, increasing the chance of unintended data exposure or unsafe execution in agent environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is limited to public-health spatial analysis, but the analyzed behavior includes geocoding, external HTTP downloads, credential management for multiple third-party services, and even hardcoded fallback credentials. This mismatch is dangerous because it conceals materially different attack surface from users and reviewers, and embedded credentials or hidden network functionality can enable unauthorized access, data exfiltration, or abuse of external accounts.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored component identified in this skill is `landsat-download`, which does not align with the stated purpose of public health spatial analysis. A mismatched vendored dependency is a supply-chain integrity concern because it may introduce unexpected code paths, permissions, network access, or data handling behavior that reviewers and users would not anticipate from the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), but the skill description does not disclose this outbound data flow. In a public-health spatial analysis context, place queries may encode sensitive operational or health-related locations, so silent transmission creates a real privacy and data-governance risk even if no code execution is involved.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback credentials, including a non-empty Earthdata username and password, which creates an embedded secret in source code. Even if framed as a fallback, any shipped default credential can be abused by anyone with code access and violates the stated design principle of not hardcoding passwords.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation explicitly claims passwords are not hardcoded, but the code later embeds a default Earthdata username and password. This mismatch is dangerous because reviewers and operators may trust the stated security model while a real secret is present in source, increasing the chance of unnoticed credential exposure and downstream compromise.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-provided place queries are transmitted to external services without a user-facing warning, consent step, or clear disclosure. In this skill's public-health setting, those queries may reveal sensitive investigation targets, clinic locations, outbreak areas, or analyst interests, making the privacy exposure more concerning than in a generic mapping tool.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Resolved AOI manifests are persisted under the user's home directory by default, which can leave a local record of searched places and derived bounding boxes without explicit disclosure. While this is a local confidentiality issue rather than a remote exploit, it can expose sensitive geographic interests or health-related work context to other local users, backups, or forensic collection.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The code hard-codes an Accept-Language preference of zh-CN for Nominatim requests, overriding user locale expectations without opt-in. This is primarily a privacy and policy concern because it leaks regional preference metadata and may influence returned results in ways users did not request, but it is lower severity than direct data exfiltration.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Hardcoded fallback credentials without clear runtime warning or disclosure can cause silent use of a shared or exposed account. In a public-health spatial analysis skill, this is especially risky because operators may unknowingly run with compromised credentials, leading to unauthorized data access, quota abuse, or attribution of activity to the wrong user.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends raw user-supplied place queries to third-party geocoding services (Open-Meteo and optionally Nominatim). Even though this is functionally necessary for geocoding, it creates a privacy and data-handling risk because potentially sensitive location queries are transmitted off-box without any disclosure, consent flow, or minimization in this component.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The Nominatim request hard-codes Accept-Language to Chinese, which silently forces locale preference without user choice. This is primarily a privacy/behavioral issue rather than a direct exploit primitive, but it can leak assumptions about user context, produce biased results, and violate least surprise in a public-health workflow that may process multinational data.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 95% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15