geoskill-sar-landslide-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:47 PM UTC
• Version: 1.0.0

Overview

The main landslide detector looks local, but the package includes under-disclosed network and credential-handling code, including embedded Earthdata credentials, so it should be reviewed before installation.

Review this skill carefully before installing. Use it only in an isolated environment, avoid relying on bbox-only synthetic outputs for real hazard decisions, and do not let it access local credential files or network services unless the publisher removes or clearly documents the credential, downloader, and geocoding helpers. The embedded Earthdata credentials should be removed and rotated by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill metadata declares a fully offline, local-processing landslide detector, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. That mismatch can mislead users and hosts into granting broader execution than expected, increasing the chance of unauthorized data access or outbound communication if the underlying implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to be a local SAR landslide detector, but analysis indicates geocoding, generic HTTP download logic, remote service access, and credential handling for multiple unrelated providers, including fallback/default secrets behavior. Hidden remote access and secret-handling in a supposedly offline geospatial tool creates serious risk of covert data exfiltration, supply-chain abuse, or misuse of stored credentials.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The vendored manifest declares the embedded component as 'landsat-download' even though the enclosing skill is a SAR landslide detection skill. This mismatch is a supply-chain integrity problem because it suggests the skill may include reused or misplaced code with capabilities outside the declared purpose, making review, provenance validation, and threat modeling unreliable.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The listed vendored files include modules such as safe_download.py and credentials.py, which imply network retrieval and credential handling capabilities not obviously required by an offline SAR landslide detection workflow. In this context, undeclared download and credential logic broadens the attack surface and could enable unexpected data exfiltration, remote fetches, or misuse of secrets if the code is reachable.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module persists query-derived AOI manifests to a local cache directory under the user's home directory and is part of a SAR landslide skill whose description does not mention filesystem side effects. Unexpected file writes and retention of location queries can expose sensitive user inputs and violate least-privilege expectations, especially in agent environments where users assume analysis-only behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and Nominatim), which creates an undisclosed external data egress path. In an agent skill focused on SAR landslide detection, transmitting AOI queries off-box is more dangerous because place names may reveal sensitive operational targets or user intent and the network dependency is not disclosed in the stated behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module hardcodes a default Earthdata username and password in source code, creating embedded credentials that can be recovered by anyone with repository or package access. Even if described as a fallback, this enables unauthorized use of the account and violates secret-handling expectations for a geospatial processing skill.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring explicitly claims passwords are not hardcoded in skill source, yet the implementation embeds a default Earthdata password. This contradiction is dangerous because it can mislead reviewers and operators into trusting the module's secret hygiene while live credentials remain exposed.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill advertises local SAR landslide detection, but a bbox-only invocation silently switches to synthetic scene generation and still emits normal-looking detection outputs. This can mislead users into treating fabricated results as real geospatial analysis, creating integrity and decision-risk issues in operational or safety-sensitive workflows.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The usage examples imply that providing only a bbox performs real detection, but the implementation uses that path to generate synthetic DEM/deformation/backscatter data instead. In a disaster-monitoring context, this deceptive behavior is dangerous because downstream users may consume fake hazard products as if they were derived from actual observations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 94% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
geopandas
shapely
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: numpy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: geopandas

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15