geoskill-sar-soil-moisture

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:46 PM UTC
• Version: 1.0.0

Overview

The main soil-moisture tool is mostly local, but the package includes under-disclosed credential handling, embedded fallback credentials, network geocoding, and persistent location caching that do not fit the advertised offline-only skill.

Review before installing. The documented SAR inversion entrypoint appears local, but the package should remove embedded credentials, narrow or split out unrelated credential/geocoding/downloader helpers, disclose any network calls and cache paths, and pin dependencies. Do not rely on this package with sensitive locations or local credential files until those issues are addressed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while the described/observed capabilities include shell execution, file read/write, environment access, and network access. This creates a trust-boundary problem: users and hosting platforms cannot accurately assess what the skill may do, and hidden capability expansion is especially risky for a nominally offline geospatial processing skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a major mismatch between the stated purpose (offline SAR soil-moisture inversion) and the broader functionality reportedly present, including unrelated network geocoding, downloading, product registries, and credential handling with hardcoded fallback credentials. Such hidden or unrelated behaviors materially increase attack surface and can enable secret exfiltration, unauthorized external access, or misuse of embedded credentials under the guise of a benign scientific skill.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring states the function computes WGS84 ellipsoidal bbox area with a spherical approximation plus ellipsoidal correction, but the implementation uses only a simple spherical trapezoid formula with radius WGS84_A and no ellipsoidal correction. In a geospatial scientific skill focused on soil-moisture inversion and correctness checks, this can mislead downstream validation, reporting, or thresholding that relies on area estimates, especially over large extents or at higher latitudes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This module aggregates access to multiple unrelated external services and secrets (Earthdata, FIRMS, CMA, OpenAI, EOG) inside a soil-moisture skill. That broadens the attack surface and violates least-privilege: any code path importing this helper can retrieve credentials unrelated to the skill’s stated function, increasing blast radius if the skill or surrounding framework is compromised.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The docstring claims passwords are not hardcoded in skill source, yet `_DEFAULTS` contains a literal Earthdata username and password. Hardcoded credentials in source are directly recoverable by anyone with repository or package access, and the misleading documentation may reduce scrutiny and delay rotation.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The skill is described as SAR soil-moisture inversion, but this file exposes place-resolution and geocoding behavior, including optional external lookup. That mismatch increases supply-chain risk because the skill performs capabilities unrelated to its stated purpose, making hidden data egress or unexpected network activity harder for users and reviewers to anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code sends user-supplied place queries to external services (Open-Meteo and Nominatim), which can disclose sensitive user intent, locations of interest, or workflow metadata to third parties. In the context of a SAR soil-moisture skill, this network behavior is not obviously necessary from the stated description, so the undisclosed external dependency and data transmission represent a genuine privacy and trust risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Place queries and derived AOI results are written to a persistent cache in the user’s home directory without user-facing disclosure or consent. That can leak sensitive location interests or operational areas to other local users, backups, forensic collection, or later processes, which is especially relevant for geospatial workflows where locations may be sensitive.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The code unconditionally sends an Accept-Language header favoring zh-CN to Nominatim, overriding user choice and disclosing a locale preference to a third party. This is a privacy and transparency issue rather than a severe exploit, but it creates unnecessary metadata leakage and can influence returned results in ways the user did not request.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file includes hardcoded fallback credentials, including a non-empty username and password, creating an embedded secret that may be used silently when environment-based configuration is absent. This can cause accidental use of shared credentials, unauthorized account access, and exposure through source distribution, backups, or package mirrors.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Hard-coding the Accept-Language header to zh-CN forces a locale choice without user consent and can alter service responses in ways the user did not request. While not a direct code-execution issue, it creates privacy and policy concerns by implicitly signaling language/region preference and by making results dependent on an undocumented locale bias.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 97% confidence
• Finding: rasterio

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15