geoskill-sar-sea-ice-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:48 PM UTC
• Version: 1.0.0

Overview

The main SAR sea-ice tool is local and coherent, but the package includes under-disclosed shared modules for third-party geocoding, downloads, and broad credential handling including hardcoded Earthdata credentials.

Review before installing. The documented CLI appears suitable for local SAR sea-ice mapping, but the package should remove or clearly disclose the unused shared helpers, eliminate hardcoded credentials, document any third-party geocoding and cache behavior, and pin dependencies. Avoid using this in sensitive environments until those issues are addressed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares itself as a local, offline SAR sea-ice mapping tool, yet the detected capabilities include environment access, file read/write, shell, and network with no explicit permission declaration. This creates an implicit trust boundary failure: operators may execute it assuming narrow geospatial processing while it can access local data and external services, increasing the risk of data exposure or unexpected system interaction.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to do offline SAR sea-ice classification, but the analyzed behavior includes geocoding, broad remote-download logic, unrelated product registries, credential handling for multiple services, and even hardcoded fallback credentials. That combination materially expands the attack surface and can enable secret leakage, unauthorized outbound access, and hidden data collection or misuse unrelated to the stated geospatial task.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill, 'landsat-download', while this package is presented as a SAR sea-ice mapping skill. That mismatch breaks provenance and supply-chain traceability: reviewers cannot reliably tell whether the bundled code matches the declared functionality, and a swapped or stale dependency could introduce unintended capabilities or hidden behavior.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The module performs live geocoding against third-party services and can persist query results, which expands the skill's behavior beyond the stated SAR sea-ice mapping function. User-provided place names may contain sensitive operational locations, and transmitting them to external services plus storing them locally creates an unnecessary privacy and data-exposure risk.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Network geocoding is a real capability increase because it sends user-supplied location queries to Open-Meteo and Nominatim, introducing external data disclosure and supply-chain dependence. In a sea-ice analysis skill, AOI resolution may be useful, but undisclosed outbound requests are still security-relevant because they expose potentially sensitive targets or areas of interest.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The code writes geocoding cache files under the user's home directory, creating persistent local storage of queried locations. This can leak user interests or sensitive operational geographies to other local users, backups, or forensic collection, even though the behavior appears intended for performance rather than abuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This credential module is over-scoped for a SAR sea-ice mapping skill: it centralizes access not only to Earthdata credentials needed for remote sensing inputs, but also to unrelated OpenAI, FIRMS, CMA, and EOG credentials. Expanding a skill's credential surface beyond its stated purpose increases the blast radius of compromise and enables unnecessary secret access if the skill or its dependencies are abused.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The module advertises and exposes OPENAI_API_KEY retrieval even though the declared pipeline is SAR sea-ice classification and does not justify LLM access. Unnecessary access to an API key for an external service creates secret-harvesting opportunities and could facilitate unauthorized outbound use under the user's account.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Retrieving FIRMS, CMA, and EOG credentials is inconsistent with the stated sea-ice classification workflow, which suggests unnecessary privilege and hidden external-service reach. Even without immediate exfiltration code in this file, broad credential availability materially increases risk if other code paths misuse these secrets.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The geocoding functions send raw user place queries to external services without any in-code disclosure, consent gate, or warning. Because AOI names can encode sensitive locations, this creates a privacy leak that is more concerning in geospatial analysis tooling where queried regions may reveal mission, research, or commercial intent.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Shipping embedded credentials in source code is a severe secret-management failure: anyone with repository or package access can reuse them, and any code importing this helper may silently authenticate with those credentials without user awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-supplied place names are transmitted to external geocoding providers without any explicit in-file consent, warning, or privacy control. In operational or sensitive contexts, place queries may reveal mission locations, research targets, or proprietary areas of interest, creating an unnecessary data disclosure channel.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15