geoskill-sar-speckle-filtering

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:48 PM UTC
• Version: 1.0.0

Overview

The main filter appears local, but the package bundles undisclosed credential, geocoding, download, and caching helpers that do not fit an offline SAR filtering skill.

Review this carefully before installing. The main command appears to perform local SAR filtering, but the package includes extra modules that can access credentials, use network geocoding, download arbitrary URLs, and write a home-directory cache if used. Install only if you trust the publisher and are comfortable with those bundled capabilities, or remove/disable the unrelated vendored modules first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill documentation declares an offline/local SAR filtering purpose, yet the static analyzer detected capabilities for environment access, file read/write, networking, and shell use without any declared permissions. This creates a transparency and trust problem: users may run the skill expecting only local image processing while it can access broader system and network resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: a SAR speckle-filtering skill allegedly includes geocoding/weather lookups, generic download functionality, credential harvesting from environment/.netrc/secrets, hardcoded NASA Earthdata credentials, and unrelated metadata registries. Such unrelated capabilities substantially expand attack surface and can enable secret exposure, unauthorized network access, and user deception about what the skill actually does.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the SAR speckle-filtering skill being audited. This is a supply-chain integrity problem because it suggests the package contents or provenance metadata were copied incorrectly, swapped, or repurposed, which can hide unintended functionality and defeat reviewer trust in what code is actually embedded.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: A local SAR speckle-filtering skill should primarily need image-processing utilities, yet the vendored inventory includes modules for download and credential handling. In this context, that mismatch increases risk because unnecessary network- and secret-related code expands attack surface, may enable unexpected external access paths, and is harder to justify as benign functionality for an offline filtering task.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements place geocoding, external network lookups, and persistent caching, which is unrelated to a SAR speckle-filtering skill’s stated purpose. Unnecessary capability expansion increases attack surface and data-handling risk, especially because it can transmit user input externally and persist it locally without being essential to filtering.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code sends user-supplied place queries to Open-Meteo and Nominatim over HTTP requests even though the declared skill is for SAR speckle filtering. This unnecessary outbound connectivity can leak sensitive user queries and creates avoidable dependency on third-party services, making the mismatch between declared purpose and actual behavior security-relevant.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The module writes persistent cache files under the user’s home directory for query results, despite this behavior being unrelated to speckle filtering. This can leave behind sensitive location-related artifacts, complicate host hygiene, and violate user expectations about what a simple image filter should store.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This SAR speckle-filtering skill includes a shared credential-management module for multiple unrelated external services, which materially expands the skill's trust boundary and capability set beyond its declared offline image-processing purpose. In this context, bundling broad credential access is suspicious because it enables access to user secrets that are not needed for Lee/Frost/multilook filtering, increasing the blast radius if the skill or any dependent code is abused.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module actively reads secrets from environment variables, ~/.netrc, and ~/.geoskill/secrets.json for several online services unrelated to the stated SAR filtering task. Even without showing network exfiltration here, indiscriminate credential harvesting from standard secret stores is dangerous because any later code path can reuse those values, and users would not reasonably expect a local denoising skill to inspect their home-directory secrets.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The module allows downloading from arbitrary URLs and writing the response to local files, which creates a network-capable primitive that can be misused for SSRF-style access to internal services or for fetching untrusted content when upstream inputs are attacker-controlled. In a speckle-filtering skill, this capability is not obviously necessary, so the context makes the exposure more suspicious rather than less.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements place-name resolution and geocoding against external services, which is materially unrelated to the declared SAR speckle-filtering purpose. In the context of a data-processing skill, hidden geocoding logic expands capability scope and can transmit user input off-host, creating an unjustified data egress and supply-chain trust risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code sends user-supplied place queries to Open-Meteo and Nominatim via outbound HTTP requests, despite the skill being described as SAR speckle filtering. That mismatch makes the network behavior unexpected and potentially privacy-impacting, especially if users assume all processing is local.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module docstring openly describes AOI/place resolution adapter behavior, which contradicts the stated SAR filtering functionality and indicates code reuse outside the advertised scope. While not directly exploitable on its own, this inconsistency is a strong indicator of hidden or unnecessary capabilities that increase attack surface and operator confusion.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User place queries are persisted to disk-derived cache records without any disclosure in this file, creating a privacy issue through silent local data retention. Even if the cache key is hashed, the manifest content itself may still reveal the original query and resolved location context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits user-provided place names to an external geocoding API without explicit disclosure in this file. This is dangerous because location queries can be sensitive, and sending them to third parties outside the stated filtering purpose creates an avoidable privacy and trust risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Nominatim fallback sends the same user place query to another third-party service, increasing exposure of potentially sensitive location data. Using multiple providers compounds disclosure risk and is especially problematic when the skill description does not justify or prominently disclose such behavior.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code contains hardcoded fallback credentials, including a concrete username and password, which is a classic secret-management failure. Embedded credentials can be extracted by anyone with source access, reused unintentionally across environments, and may grant unauthorized access if still valid.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The module silently reads a sensitive secrets file from the user's home directory and merges its contents into runtime defaults. In the context of a SAR filtering skill, undisclosed access to user secret material is dangerous because it violates least surprise and can expose unrelated credentials to downstream code without a task-based justification.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The module reads credential-bearing environment variables implicitly during helper resolution, with no runtime indication to the user that secret material is being consumed. For an offline geospatial filter, this hidden secret access is risky because it broadens sensitive data exposure beyond user expectations and can feed later network-capable code paths.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module transmits raw user-provided place queries to third-party services without any user-facing warning or consent mechanism in this file. This creates a privacy and compliance risk because location-related input may be sensitive and users of a SAR image filter would not reasonably expect network disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The request hard-codes `Accept-Language: zh-CN,zh;q=0.9` for Nominatim without user choice or clear justification. This is lower severity than the unexpected network access itself, but it can reveal assumptions about user locale, affect returned results, and create avoidable privacy and policy concerns.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 91% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 88% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15