Security audit
Security checks across malware telemetry and agentic risk
The main classifier is local, but the package includes undisclosed credential and network helper code, including hardcoded Earthdata credentials, so it should be reviewed before install.
Install only after the publisher removes the hardcoded Earthdata credentials, narrows or removes the unrelated credential/geocoding/downloader modules, documents any network lookups and cache locations, and pins supported dependency versions. The core classifier appears local, but the bundled helper code has broader authority than the skill description explains.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy scikit-learn
numpy rasterio scipy scikit-learn
numpy rasterio scipy scikit-learn
numpy rasterio scipy scikit-learn
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution