geoskill-sar-wind-speed

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:48 PM UTC
• Version: 1.0.0

Overview

The main SAR wind command appears local, but the package also ships under-disclosed geocoding, downloading, and credential-handling code that does not fit the advertised offline workflow.

Review this package before installing in an environment with private credentials or sensitive locations. The advertised command can run locally, but the bundled shared modules should be removed or clearly gated unless you intentionally want geocoding, generic downloading, local location caching, and broad credential access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares no permissions, yet the analyzed capabilities indicate access to environment variables, filesystem I/O, shell execution, and network. That mismatch prevents users and policy engines from making informed trust decisions and can hide unexpectedly powerful behavior, especially in an agent ecosystem where skills may be auto-invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is narrow SAR wind retrieval, but the skill reportedly also includes geocoding, generic downloading, broad remote-sensing registries, and credential handling with hardcoded fallback credentials. This significantly expands the attack surface and creates a covert-behavior risk: a user invoking a local scientific workflow may unknowingly trigger external requests, credential use, or unrelated data handling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the bundled core belongs to a different skill ('landsat-download') than the audited SAR wind-speed skill. This mismatch can break provenance checks, confuse reviewers, and mask accidental or unauthorized code reuse, making supply-chain auditing and incident response less reliable. In this context, the file is specifically meant to document vendored component identity, so incorrect identity metadata is more dangerous than a harmless labeling issue.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This module expands the skill’s effective capabilities beyond SAR wind inversion by performing geocoding and persisting AOI lookups locally. That is dangerous because user-supplied place names and derived location metadata may be disclosed to external services and retained on disk without being clearly necessary for the stated algorithmic purpose, increasing privacy and data-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code sends location queries to Open-Meteo and Nominatim, which are third-party services unrelated to the core SAR inversion math. In this skill context, that creates an unnecessary data egress path for potentially sensitive place queries and introduces external dependency behavior that users may not expect from an offline geophysical processing skill.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The module defines a cache directory under the user’s home folder and later writes resolved location manifests there. Persistent storage of queried places and derived coordinates can expose historical user interests or operational locations to other local users, backups, or forensic collection, especially when not clearly justified by the skill’s stated purpose.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring states that network issues raise NetworkError, but the HTTP helpers swallow exceptions and return empty results, which are then surfaced as NoMatchError. This is dangerous because callers cannot distinguish connectivity failures from genuine resolution misses, potentially causing silent fallback behavior, incorrect operational decisions, or repeated unnecessary requests.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This credential module exposes accessors for multiple unrelated services, including OpenAI, CMA, FIRMS, and EOG, despite the stated skill being limited to SAR wind-speed inversion. Broad credential access increases blast radius: any downstream code importing this module can retrieve secrets unrelated to the skill’s function, enabling unnecessary privilege expansion and potential cross-service secret misuse.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The presence of an OpenAI API key accessor is unjustified for a SAR wind-field inversion skill and creates a direct path to exfiltrate or misuse LLM credentials. In this context, access to an unrelated paid external API is especially risky because the skill has no legitimate need for that secret, so any use would be suspicious by default.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file exposes a reusable generic downloader that can fetch arbitrary URLs and write them to arbitrary local paths, which exceeds the narrowly stated SAR wind inversion purpose. Even though it includes safety features such as temp files, retries, and optional hashing, those controls do not restrict destination or source, so the skill can still be used as a general network/file ingress primitive within an agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The HTTP helper accepts arbitrary URLs and returns streamed content without validating scheme, host, or content type, creating a general-purpose network access capability unrelated to SAR wind inversion itself. In an agent setting, this can be abused to retrieve attacker-controlled payloads, exfiltration staging inputs, or unexpected large/untrusted files, especially because SHA256 verification is optional rather than mandatory.

Context-Inappropriate Capability

High

• Confidence: 81% confidence
• Finding: The file sends user-supplied place names to third-party geocoding services (Open-Meteo and Nominatim), which creates an external data-exfiltration surface not clearly justified by the declared SAR wind inversion purpose. In a skill context, hidden outbound requests can leak sensitive locations, mission targets, or user intent to external providers, especially when users may expect local geospatial processing only.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: User-entered place names are transmitted to external geocoding services without any visible warning in this file. In a SAR analysis skill, queried locations may correspond to sensitive areas of interest, so silent transmission can create privacy, compliance, or mission-disclosure risk even if the code is not overtly malicious.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The code caches resolved location data into the user’s home directory without a visible warning or consent flow. While the cached data is not a direct code execution risk, it can persist sensitive geographic intent and derived coordinates longer than users expect, making privacy exposure more likely on shared or monitored systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes a real-looking Earthdata username and password as fallback defaults. Hardcoded credentials are a severe secret-management failure: if valid, they grant unauthorized access; if invalid or test-only, they still train consumers to rely on embedded passwords and may expose a real user account in source control and derivative artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 73% confidence
• Finding: Forcing the Accept-Language header to a Chinese locale without user choice can disclose user or deployment assumptions and may affect returned results in ways the user did not request. While not severe on its own, it is an unnecessary privacy and transparency issue in outbound requests to a third party.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 91% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 84% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 87% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: rasterio

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15