Security audit

geoskill-sar-flood-mapping

Security checks across malware telemetry and agentic risk

Overview

The main flood-mapping command is local, but the package includes undisclosed credential handling, network helpers, home-directory caching, and mismatched vendored provenance metadata.

Review this skill before installing. The documented flood-mapping command appears to operate locally, but the package also ships unused or under-documented network and credential modules, including embedded fallback Earthdata credentials and home-directory cache behavior. Prefer a cleaned package that removes unrelated vendored modules and hardcoded credentials, documents any network use, and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation declares no permissions, yet the detected capabilities include shell execution, file read/write, environment access, and network use. This is dangerous because users and policy systems may trust the stated offline/local behavior while the underlying skill can access broader resources than disclosed, increasing the chance of unauthorized data access or command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is narrow geospatial flood mapping, but the detected behavior includes external geocoding, generic downloading, unrelated metadata registries, broad credential management, and embedded default Earthdata credentials. This mismatch is dangerous because it hides materially expanded attack surface and sensitive secret handling behind an apparently simple offline mapping skill, enabling credential leakage, unauthorized outbound access, and supply-chain style abuse.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The vendored metadata identifies the embedded core as belonging to a different skill ('landsat-download') than the advertised SAR flood-mapping skill. This kind of identity mismatch undermines provenance and reviewability, making it easier to smuggle unrelated code, confuse auditors, or cause the wrong dependency set to be trusted during packaging or validation.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Labeling the vendored code as 'landsat-download' directly contradicts the apparent identity of this SAR flood-mapping skill. Even if accidental, this discrepancy is security-relevant because it can mislead trust decisions, break provenance tracking, and hide supply-chain substitution or repackaging errors that would be harder to detect in review.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module performs outbound geocoding requests to third-party services and persists query results to a cache under the user's home directory, even though the skill description focuses on SAR flood mapping outputs rather than networked place-resolution behavior. In a security review, undisclosed external data exfiltration and local persistence are real concerns because user-supplied place names, AOI interests, and usage patterns may be sent to external services and stored without explicit consent.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: This file exposes a general-purpose online geocoding path that is broader than the narrowly stated flood-mapping function, increasing the skill's effective capabilities beyond what users may expect. Capability expansion matters because it introduces unnecessary network dependencies, third-party data sharing, and a wider attack and privacy surface for a skill that could otherwise operate on explicit AOIs or offline bounding boxes.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This file hardcodes a real-looking Earthdata username and password as fallback credentials, which is a direct secret exposure. Even if intended as a convenience fallback, embedding reusable credentials in source control can leak account access to anyone with repository access and encourages unauthorized use of external services.

Natural-Language Policy Violations

Medium

Confidence: 75% confidence
Finding: Forcing Accept-Language to zh-CN for Nominatim requests without user choice is primarily a privacy and transparency issue: it reveals locale assumptions and can leak user regional affinity or bias service responses in ways users did not request. In a geospatial skill handling potentially sensitive AOIs, silent request shaping to a third party is a meaningful trust and policy concern.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Network geocoding and persistent caching happen silently, without user-facing notice, which means sensitive place queries can be transmitted externally and retained locally without informed consent. For flood-response or disaster-analysis workflows, AOIs may reveal operational interests or affected locations, so undisclosed transmission and storage increase privacy and operational risk.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: Writing cache files under the user's home directory without disclosure creates an undisclosed persistence channel for place queries and resolved AOIs. The direct technical impact is limited, but it can expose sensitive workflow history to other local processes or users with access to the account and violates least-surprise expectations.

Missing User Warnings

High

Confidence: 100% confidence
Finding: Hardcoded fallback credentials are a genuine vulnerability because they embed a usable secret directly in code without any runtime warning or opt-in. In the context of a flood-mapping skill, this is especially dangerous because consumers may unknowingly authenticate as a shared account, leading to account compromise, abuse, and loss of auditability.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Forcing the Accept-Language header to zh-CN for Nominatim requests without user consent can leak user locale assumptions and alter geocoding results in ways the user did not request. In a geospatial workflow, this can produce incorrect or biased place resolution, causing downstream flood mapping to run on the wrong area and undermining result integrity.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio geopandas shapely
Confidence: 95% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio geopandas shapely scipy
Confidence: 95% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio geopandas shapely scipy
Confidence: 95% confidence
Finding: geopandas

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio geopandas shapely scipy
Confidence: 93% confidence
Finding: shapely

Unpinned Dependencies

Low

Category: Supply Chain
Content: rasterio geopandas shapely scipy
Confidence: 95% confidence
Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15