geoskill-sediment-transport-modeling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:49 PM UTC
• Version: 1.0.0

Overview

The main sediment-modeling tool is local and coherent, but the package also bundles under-disclosed credential, download, and geocoding helpers that do not fit the documented offline privacy claim.

Review before installing. The normal sediment-modeling command appears local, but the package should remove the hardcoded credentials, remove or clearly document unused network/credential helpers, correct the vendored-core metadata, and pin dependencies before broad use, especially in environments with local Earthdata, OpenAI, FIRMS, EOG, or other secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation declares no permissions, yet the detected capabilities include environment access, file read/write, shell, and network. This creates a transparency and least-privilege problem: users and orchestrators may authorize or run the skill under a false assumption that it is offline and low-risk, while the implementation can access secrets, modify files, and reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is sediment transport modeling, but the detected behavior includes credential harvesting paths (.netrc, env vars, secrets files), built-in fallback Earthdata credentials, online geocoding, generic HTTP downloading, and metadata registry functions unrelated to the stated task. This mismatch is dangerous because it hides sensitive data access and outbound connectivity inside a scientific skill, increasing the risk of secret exposure, unauthorized network activity, and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the advertised sediment-transport modeling skill. This supply-chain/integrity mismatch means users and reviewers cannot reliably determine what code is actually bundled, increasing the risk of hidden capabilities or repurposed code being executed under misleading packaging.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The vendored file list includes download and credential-handling components that are not obviously required for a sediment transport modeling skill. Unnecessary network and secret-handling capabilities expand the attack surface and could enable unauthorized data access, credential misuse, or unexpected external communications if invoked.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly claims passwords are not hardcoded, yet the `_DEFAULTS` map contains a real-looking fallback username and password. Hardcoded credentials in source control are dangerous because anyone with repository access can recover and reuse them, and downstream code may silently authenticate with them in production.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: This module provides a reusable arbitrary remote file download primitive that is broader than the stated sediment-transport modeling purpose. In an agent/skill context, generic downloading can be repurposed to fetch untrusted payloads, enable data exfiltration workflows, or expand the skill’s operational scope beyond what users expect, especially because URL allowlisting and mandatory integrity verification are not enforced by default.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and Nominatim), which creates an external data egress path. If users provide sensitive locations or internal project names, that information is disclosed to external services without any visible consent gate, and availability of the skill also becomes dependent on those remote endpoints.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: User-supplied place names are transmitted to third-party geocoding services without any disclosure or consent mechanism in this module. In many deployments, location queries can contain sensitive project, customer, or operational information, creating unintended data exposure to external providers and possible compliance issues.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The `_DEFAULTS` block contains hardcoded fallback credentials with no runtime warning, meaning the application may silently use embedded secrets if no environment or user secret is set. This creates unauthorized access risk, makes credential leakage persistent across all deployments, and can hide insecure operation from users and operators.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15