geoskill-sar-ship-detection

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:47 PM UTC
• Version: 1.0.0

Overview

The advertised SAR detector is mostly local, but the package also contains under-disclosed credential, geocoding, download, and cache helpers, including a hardcoded Earthdata username and password.

Review this package before installing. The core ship-detection script appears purpose-aligned, but the distribution should remove the hardcoded Earthdata credentials, strip unused credential/geocoding/downloader helpers, disclose any network geocoding explicitly, and pin dependencies before it is treated as a routine local-only skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation declares an offline local SAR detection tool, yet the static analysis indicates capabilities for environment access, file read/write, shell, and network without explicit permission declaration. Undeclared powerful capabilities reduce transparency and can enable unexpected data access or command execution, especially if users trust the skill to be purely local and constrained.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: a ship-detection skill allegedly also handles credentials, reads secrets from environment and local files, performs online geocoding/weather access, and includes generic download infrastructure unrelated to the stated purpose. Such hidden functionality materially increases the risk of credential exposure, unintended exfiltration, and user deception because operators may grant trust based on the narrow advertised SAR workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the advertised SAR ship-detection skill. This indicates a supply-chain integrity or packaging mismatch: operators may be reviewing, trusting, or hashing one component while actually shipping another context, which can hide incorrect dependencies, stale code, or intentionally swapped artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code sends user-supplied place names to external geocoding services, which creates a privacy and data-governance risk not obviously required by a SAR ship-detection skill. In this context, AOI queries may reveal sensitive operational interests or locations, and the behavior is more concerning because it occurs automatically as part of fallback resolution.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: Writing persistent cache files under the user's home directory stores geocoding queries and derived AOI data beyond the current run. While not code-execution dangerous, this can leak sensitive place interests to other local users, backups, or forensic review, especially in geospatial or intelligence-adjacent workflows.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module aggregates access to multiple unrelated external services and local credential stores inside a SAR ship-detection skill, expanding the skill's privilege surface far beyond its stated purpose. In an agent setting, such broad credential brokerage increases the chance of unauthorized secret access or reuse by other code paths, making compromise or misuse materially more dangerous.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Exposing an OpenAI API key accessor in a skill that does not require LLM functionality is an unnecessary secret-access capability. Even without direct exfiltration code in this file, providing a helper for unrelated API keys enables later components to retrieve and misuse that credential, violating least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module supports FIRMS, CMA, and EOG credentials despite the declared SAR ship-detection purpose not clearly depending on those services. This mismatch broadens accessible secrets and creates avoidable attack surface if the skill or surrounding agent can call these helpers opportunistically.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file exposes place-name resolution functionality and can transmit user-supplied locations to external geocoding services, which is materially outside the stated SAR ship-detection purpose. In a security review, this kind of capability mismatch is dangerous because it expands the skill's data flows and attack surface in ways users and operators may not expect.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The legacy fallback performs live HTTP requests to Open-Meteo and Nominatim using user-controlled place queries, creating undeclared outbound network behavior. In the context of a SAR ship-detection skill, this unjustified capability increases privacy risk, supply-chain dependence on third parties, and the possibility of hidden data exfiltration through seemingly unrelated functionality.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-provided place queries are transmitted to third-party geocoding endpoints without any visible consent or disclosure path in the code. In a SAR ship-detection setting, these queries can expose mission targets, monitoring interests, or sensitive locations to external services, making the issue more serious than in a generic consumer app.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete Earthdata username and password. Embedded secrets in source code are highly dangerous because anyone with repository or package access can extract and reuse them, and downstream users may unknowingly authenticate with shared credentials that can be abused or burned.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends user-provided place strings to third-party APIs without any user-facing notice or consent mechanism in this file. That creates a privacy and compliance risk because sensitive mission areas, operational interests, or analyst queries may be disclosed to external providers.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Forcing the Accept-Language header to Chinese without user opt-in is not severe by itself, but it is an unnecessary hard-coded behavior that may alter query handling and reveal assumptions about the user or deployment context. Combined with undisclosed external requests, it increases the mismatch between expected and actual network behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 99% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
geopandas
shapely
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: numpy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: geopandas

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15