Security audit

geoskill-sar-forest-biomass

Security checks across malware telemetry and agentic risk

Overview

The main biomass tool appears local, but the package also contains undisclosed network, download, cache, and credential-handling code, including embedded Earthdata credentials.

Review before installing. The biomass entrypoint itself is largely local, but the package should remove or clearly document the unused geocoding, downloader, cache, and credential modules, delete and rotate the embedded Earthdata credentials, and pin dependencies. Use it only in an environment where unexpected network-capable helper code and home-directory credential reads are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no permissions, yet the analyzed capability set includes environment access, file read/write, network, and shell execution. This creates a dangerous transparency gap: users and orchestrators may treat the skill as local-only SAR processing while it can access secrets, modify files, invoke commands, and reach external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is narrow biomass estimation, but the detected behavior includes geocoding/network access, resumable downloading, credential management from env/.netrc/secrets, and even fallback default NASA Earthdata credentials. This is a severe scope mismatch that can conceal exfiltration, unauthorized remote access, or supply-chain style misuse under the guise of a scientific raster-processing skill.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The vendored metadata shows this skill bundles a separate component named 'landsat-download', which is materially different from the declared SAR forest biomass estimation purpose. This kind of capability mismatch is a supply-chain and transparency risk because it can introduce undeclared functionality such as remote data access, credential use, or broader file/network behaviors that reviewers and users would not expect from the skill description alone.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The listed vendored files include modules such as 'safe_download.py' and 'credentials.py', which imply network retrieval and secret-handling capabilities not obviously required for a biomass inversion skill. In this context, undeclared download and credential functionality expands the attack surface and could enable data exfiltration, unauthorized external access, or misuse of stored credentials if the vendored code is invoked.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file implements geocoding, network access, and persistent caching capabilities that materially exceed the stated SAR biomass inversion purpose. Scope expansion is dangerous because it introduces unnecessary data egress and local-state persistence, increasing privacy and attack surface without clear need for the declared skill.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This code sends user-supplied place queries to third-party services (Open-Meteo and Nominatim), which can disclose sensitive operational context such as locations of interest. In a biomass-analysis skill, such outbound transmission is not obviously required by the advertised function, so it creates unjustified privacy and supply-chain exposure.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The code defines a persistent cache under the user's home directory for geocoding results, creating undisclosed local retention of queried places. Even if the data is not highly sensitive by itself, location queries can reveal user interests or projects and should not be stored persistently without need and disclosure.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The docstring promises ambiguous handling without silently taking the first result, but the resolver ultimately sorts candidates and selects the top match automatically. This mismatch can cause silent AOI misresolution, leading downstream analysis to run on the wrong geographic area with no explicit confirmation.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This credential module exposes accessors for multiple unrelated external services (OpenAI, CMA, FIRMS, EOG) that are not justified by a SAR forest biomass estimation skill. Broadening the available credential surface increases the chance of unnecessary account access, misuse by downstream code, and lateral abuse if the skill or agent is compromised.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The module hardcodes a default Earthdata username and password in source code, creating a built-in account capability that anyone with code access can reuse. Embedded credentials are inherently sensitive, difficult to rotate safely, and can enable unauthorized access well beyond the skill's core functionality.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The exported API delegates to external AOI/place-resolution logic that is unrelated to the declared SAR forest biomass inversion purpose. This kind of scope drift increases attack surface and can cause unexpected outbound data flows or hidden capabilities in a skill users would reasonably expect to be purely analytical.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The legacy fallback preserves full remote geocoding capability via Open-Meteo and Nominatim, extending functionality well beyond biomass estimation. Hidden fallback networking is especially risky because it can bypass assumptions made by reviewers or operators about what the skill does and what data leaves the environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: User-provided place names are transmitted to external geocoding providers without any disclosure in this file, which creates a privacy issue and potential leakage of sensitive geographic intent. In a geospatial workflow, queried places may directly encode project sites, customer assets, or research targets.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Resolved place queries and associated AOI data are written to disk in the user's home directory without clear disclosure or consent. Persistent storage of location-derived metadata can expose sensitive work patterns to other local users, backups, or forensic review.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Plaintext fallback credentials are embedded directly in the code without runtime consent or clear user disclosure. This creates immediate credential exposure to anyone who can read the repository or package and can result in unauthorized use of the associated account.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: User-supplied place names are sent to third-party geocoding services without an explicit warning, which creates a privacy and data-governance issue. Even if the data is not highly sensitive by default, place queries can reveal locations of interest, projects, or operational context that users may not expect to share externally.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy scikit-learn
Confidence: 98% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy scikit-learn
Confidence: 98% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy scikit-learn
Confidence: 98% confidence
Finding: scipy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy scikit-learn
Confidence: 99% confidence
Finding: scikit-learn

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 87% confidence
Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: scipy

Known Vulnerable Dependency: scikit-learn — 6 advisory(ies): CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more

Critical

Category: Supply Chain
Confidence: 93% confidence
Finding: scikit-learn

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15