Geoskill: Sentinel1 Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:08 AM UTC
• Version: 5.0.1

Overview

The skill mostly matches a Sentinel-1 downloader, but it ships an unrelated credential module with a hardcoded Earthdata username and password and under-discloses some place lookup privacy behavior.

Review before installing. The downloader behavior itself is largely normal, but the package should remove the hardcoded Earthdata credential fallback, drop or isolate unrelated credential helpers, document Open-Meteo/Nominatim place lookup and the home-directory AOI cache, and tighten the requests dependency before broad use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly claims passwords are not hardcoded in skill source, but `_DEFAULTS` contains a real-looking Earthdata username and password. This creates a direct secret exposure risk and is especially concerning because the misleading documentation may cause reviewers and users to underestimate the danger.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The cache persists user-supplied place queries and resolved locations to a predictable directory under the user's home folder without consent, retention controls, or permission hardening. Location queries can be sensitive, and local persistence can expose travel plans, addresses, or investigation targets to other local users, backups, or later forensic access.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code sends user-provided place names to a third-party geocoding API, which can disclose sensitive location intent to external services and network observers. In a skill context, users may not expect their queries to leave the local environment, especially given the file's 'offline first' framing and silent network fallback.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The Nominatim fallback transmits the user's query to another third-party service without explicit consent, further expanding data sharing beyond the first provider. Chaining fallbacks increases privacy risk because failed or ambiguous lookups may be sent to multiple external endpoints, creating broader exposure of potentially sensitive location searches.

Natural-Language Policy Violations

Medium

• Confidence: 73% confidence
• Finding: Forcing the 'Accept-Language: zh-CN,zh;q=0.9' header can leak user or deployment regional assumptions and influence provider-side profiling or localization without user choice. While lower severity than direct query transmission, it unnecessarily adds metadata to outbound requests and may return locale-biased results inconsistent with user expectations.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code ships with a concrete fallback username and password that appear usable, so any deployment missing environment configuration may silently use exposed credentials. Hardcoded fallback secrets are dangerous because they can be extracted from source, reused by unauthorized parties, and accidentally propagated into downstream forks or packages.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends user-supplied place queries to third-party geocoding services over the network, which can disclose sensitive location intent or private user input without explicit consent or visibility. In an agent skill context, users may reasonably assume local processing, so silent external transmission creates a meaningful privacy and data-handling risk.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: Forcing the Accept-Language header to zh-CN affects user privacy and autonomy by imposing a locale preference that the user did not choose, and it may also influence returned place labels in unexpected ways. While not a direct compromise vector, it can leak assumptions about deployment region and produce behavior inconsistent with user expectations or policy requirements.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 95% confidence
• Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:17