geoskill-sar-backscatter-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:46 PM UTC
• Version: 1.0.0

Overview

The main SAR statistics tool is local, but the package also ships under-disclosed network, download, and credential-handling code including a hardcoded Earthdata password.

Review this package carefully before installing. Use it only in an environment where you are comfortable with the bundled code having access to local files and possible network-capable helpers; avoid running it with sensitive ~/.netrc, ~/.geoskill/secrets.json, or API keys present unless the extra vendored modules are removed or audited.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation declares no permissions, yet the detected capabilities include shell, filesystem, environment access, and network use. This creates a transparency and least-privilege failure: users and orchestrators may invoke the skill believing it is offline/local while it can read/write files and make outbound requests. In this context, the mismatch is especially concerning because the README explicitly claims offline/local processing, which can mislead users about data exposure and execution risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is a local SAR time-series statistics tool, but the analyzed behavior includes unrelated remote product registries, geocoding, generic downloading, and credential management for multiple third-party services, including embedded fallback credentials. This large description-behavior mismatch is dangerous because it hides materially broader attack surface and data-flow than users expect, enabling covert network access, misuse of credentials, or access to unrelated services under the guise of a simple geospatial analysis skill. The 'runs offline by default' and 'no user data is uploaded' statements make this more dangerous by increasing the likelihood that operators trust and execute it with sensitive local data.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata claims the embedded core package is for a different skill ('landsat-download') than the surrounding SAR backscatter analysis skill. This is a supply-chain/integrity problem because reviewers and tooling may validate the wrong artifact provenance, allowing unexpected code or mismatched dependencies to be packaged under misleading metadata. In this context, the mismatch is more suspicious because the file is specifically meant to document vendored content integrity.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The code sends user-supplied place queries to external geocoding services, which creates a privacy and data-exposure risk because sensitive locations may be disclosed to third parties. In this skill context, SAR analysis may involve operationally sensitive areas, so undeclared network egress is more concerning than in a generic mapping tool.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module centralizes access to multiple unrelated external-service credentials in a SAR backscatter analysis skill, expanding the skill’s privilege surface well beyond its stated purpose. In context, unnecessary credential plumbing increases the risk that the skill or adjacent code can access sensitive accounts and perform outbound authenticated actions unrelated to SAR statistics.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: Providing access to OpenAI API credentials despite no stated need for LLM functionality creates unnecessary secret exposure and potential for unauthorized paid API use or data exfiltration. In a non-LLM geospatial skill, this mismatch is suspicious because it grants capabilities unrelated to the declared functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Support for FIRMS, CMA, and EOG credentials is unrelated to the described SAR backscatter statistics task and broadens the accessible secret set. Even without direct exfiltration code in this file, unnecessary credential access increases blast radius if the skill or surrounding framework is compromised or abused.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module provides a reusable generic downloader with retries, resume, and arbitrary destination paths, which materially expands the skill’s capabilities beyond the stated SAR time-series statistics purpose. In an agent setting, unjustified download primitives increase the risk of misuse for fetching untrusted payloads, staging data exfiltration workflows, or enabling SSRF-like access to internal resources if URLs are user-controlled.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The `_http_get` helper accepts arbitrary URLs and supports both `requests` and `urllib`, creating a broad network-fetch surface unrelated to the declared analysis-only SAR statistics behavior. In a tool-execution environment, this can be abused to contact attacker-controlled hosts or potentially internal endpoints, making the skill more dangerous than its metadata suggests.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file exposes place-resolution functionality that is materially outside the stated purpose of SAR backscatter time-series statistics. In an agent skill, hidden or unjustified geocoding capabilities expand the attack surface, enable external data flow, and can facilitate collection or transmission of user-supplied location inputs without clear need or disclosure.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code issues live requests to external geocoding services (Open-Meteo and Nominatim), which creates outbound network capability not justified by the advertised SAR-statistics behavior. In an agent environment, this can leak sensitive place queries, introduce supply-chain and availability risks from third-party services, and bypass operator expectations that the skill performs local raster/statistical processing only.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module header presents the file as a simple adapter shim, but the file still embeds a full legacy geocoding implementation with network behavior. This mismatch is dangerous because it obscures real capabilities during review, increasing the chance that risky code is trusted, overlooked, or deployed under incorrect assumptions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Place queries are transmitted to third-party geocoding providers without any user-facing warning in this file, which can leak sensitive location intent or target areas. In a SAR backscatter analysis skill, AOIs may correspond to sensitive facilities, disaster zones, or monitoring targets, making undisclosed sharing more dangerous.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The code persists resolved location queries in a cache under the user's home directory without explicit disclosure, which can leave a recoverable history of sensitive places. While this is local rather than remote exposure, it still creates privacy risk on shared systems or in environments with backup/forensic collection.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials with a real-looking username and password, which is a direct secret exposure and an authentication misuse risk. If valid, anyone with source access can reuse them; even if stale, this pattern normalizes shipping passwords in code and may lead the application to silently authenticate as a shared account.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice is a questionable privacy and policy behavior because it hardcodes locale assumptions and may influence external-service responses in ways users did not request. While not severe on its own, it is another sign of undeclared network-side behavior and unnecessary request shaping in a skill whose declared purpose is unrelated to geocoding.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 83% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 83% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 83% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 82% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 84% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 86% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15