Security audit

geoskill-sar-urban-mapping

Security checks across malware telemetry and agentic risk

Overview

The advertised SAR mapping tool is mostly local, but the package also bundles undisclosed network geocoding, downloader, persistent cache, and credential-management code including hardcoded fallback credentials.

Review this package before installing. The documented SAR mapping command appears local, but the package contains extra network, cache, and credential code that is not disclosed in the skill instructions; avoid using it with sensitive locations or credentials unless those extra modules are removed or clearly scoped, and any exposed Earthdata credential has been rotated.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no permissions while the analyzed implementation reportedly has capabilities for environment access, file read/write, shell, network, and broader code execution surfaces. That mismatch is dangerous because users and orchestrators may grant or run the skill under a false assumption of limited offline behavior, increasing the chance of unintended data access or command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a strong description-behavior mismatch: the skill is presented as a local SAR urban-mapping tool, but static analysis indicates unrelated geocoding, downloading, credential handling, multiple external-service integrations, and even embedded fallback credentials. Hidden network access and credential logic materially expand the attack surface and create risks of secret exposure, unauthorized outbound requests, or abuse far beyond the stated geospatial task.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the declared SAR urban mapping skill, which indicates a supply-chain integrity or packaging mismatch. Even though this file is metadata rather than executable code, such inconsistencies can hide accidental dependency mix-ups, incorrect provenance, or malicious substitution of vendored components, making review, updates, and trust validation unreliable.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The module sends user-supplied place names to external geocoding services and may enrich results through a second provider, which expands the skill's behavior beyond a purely local SAR mapping pipeline. In a geospatial workflow this creates a real data egress surface: sensitive AOI names can be disclosed to third parties and the returned AOI can be influenced by network responses, affecting downstream analysis.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The code persists geocoding results under the user's home directory, outside the skill's declared outputs. This is a real security/privacy issue because user queries may contain sensitive locations, and undisclosed persistent writes create residual data that other local users, processes, or later runs can inspect.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This credential module is far broader than the stated SAR urban-mapping need and includes accessors for OpenAI, CMA, FIRMS, EOG, Earthdata, .netrc, and user secrets. Expanding a skill’s credential surface beyond least-privilege needs increases the chance that unrelated secrets are accessed, exposed, or abused if other code in the skill imports this helper.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file adds place-name geocoding and external resolution logic that is not justified by the declared SAR urban mapping purpose. In a skill advertised as raster/SAR processing, hidden or secondary networked geocoding expands the trust boundary, can leak user-supplied locations to third parties, and creates undeclared behavior inconsistent with least privilege.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code performs outbound HTTP requests to Open-Meteo and Nominatim using user-provided place strings, creating undeclared data egress and dependency on third-party services. This is dangerous because sensitive or proprietary locations can be transmitted externally, and the capability is broader than the manifest suggests, making review and sandbox policy enforcement harder.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The compatibility-shim description downplays that the fallback path preserves full network-based place resolution. That mismatch can mislead reviewers into believing this file is merely an adapter, when in fact it retains substantial undeclared functionality with external communications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The cache file stores user place queries and geocoding outputs persistently without any disclosure in this file. That is dangerous because AOI names can reveal sensitive project locations, and silent retention increases privacy risk and forensic exposure beyond the expected outputs of an urban mapping skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: External requests send user-provided place data to Open-Meteo and optionally Nominatim without an explicit warning in this code. In the context of AOI selection, these queries may expose confidential sites, investigations, or customer locations to third-party services, making this a genuine privacy and data-governance issue.

Missing User Warnings

High

Confidence: 100% confidence
Finding: The code contains hardcoded fallback credentials, including a concrete Earthdata username and password. Embedding real credentials in source creates immediate secret exposure risk through source distribution, logs, forks, backups, and downstream reuse; in a shared skill ecosystem this is especially dangerous because anyone with code access may reuse the account.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 94% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 95% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 94% confidence
Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15