geoskill-sentinel1-tile-management

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:50 PM UTC
• Version: 1.0.0

Overview

The main Sentinel-1 tool is local, but the package ships undisclosed credential, geocoding, download, and cache code including a real-looking embedded password.

Review before installing. The advertised CLI appears to perform local raster processing, but the package should not ship embedded credentials, unrelated credential readers, undisclosed geocoding/network helpers, or home-directory caches without clear opt-in and documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored core metadata names a different skill ('landsat-download') than the actual Sentinel-1 tile-management skill, which indicates a supply-chain integrity mismatch. Even though this file is only metadata, such inconsistencies can cause reviewers or tooling to trust the wrong provenance, potentially masking accidental or malicious code substitution in the bundled core.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The module persists query-derived AOI cache files under the user's home directory without clear disclosure or opt-in. This can leak sensitive place queries and derived locations to disk, where other local users, backup systems, or later processes may access them unexpectedly.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: This credential module supports multiple unrelated external services (OpenAI, CMA, FIRMS, EOG) despite the declared skill being a Sentinel-1 preprocessing workflow. Broad credential-handling scope increases attack surface, creates unnecessary privilege aggregation, and makes accidental credential exposure or misuse more likely if other parts of the skill import this shared helper.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The module hardcodes default fallback credentials, including a real-looking Earthdata username and password, directly in source code. Hardcoded secrets in version-controlled code are highly dangerous because anyone with repository access can reuse them, and downstream logs, forks, or package distributions may further expose them.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: This file vendors a reusable network downloader with resume, retries, and integrity-check support, which materially expands the skill's capability beyond the declared Sentinel-1 preprocessing-only scope. In a constrained skill ecosystem, this mismatch is dangerous because it enables arbitrary external fetches that can introduce unreviewed data ingress, policy bypass, or later-stage payload delivery unrelated to the stated geospatial transformation task.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The `_http_get` and surrounding download flow provide broad external network retrieval for arbitrary URLs, which is unjustified by a preprocessing skill whose stated role is local raster conversion, clipping, QA, and logging. Even though the code includes some safety features, the core issue is capability overreach: arbitrary download primitives can be repurposed for data exfiltration staging, retrieval of malicious inputs, or supply-chain abuse within an otherwise trusted processing skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The module includes full online place-resolution behavior that is outside the stated Sentinel-1 GRD preprocessing scope, creating hidden capability for external data transmission and behavior drift. In a preprocessing skill, unexpected geocoding expands the attack surface, can leak user-supplied AOI/place inputs to third parties, and makes execution dependent on external services not disclosed by the manifest.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code sends user-provided place queries to Open-Meteo and Nominatim via outbound HTTP requests, which is not justified by the advertised preprocessing-only purpose. This creates privacy and supply-chain risk because sensitive locations or task context may be disclosed to third parties and results can be influenced by external services.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring presents the file as a simple delegation shim, but the fallback preserves complete network-capable legacy behavior. That mismatch is dangerous because reviewers and operators may assume the module is low-risk while it still performs external resolution and data egress under failure conditions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Place queries are sent to third-party geocoding services automatically and without an explicit user-facing warning or confirmation. If users provide sensitive locations, this creates a privacy leak to external providers and may violate expected offline or local-only processing assumptions in a geospatial preprocessing skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Resolved AOI queries are written to a persistent cache in the user's home directory without explicit disclosure. Because place names and AOIs can reveal sensitive operational interests or locations, this creates an unnecessary local privacy exposure beyond what users may expect from a preprocessing tool.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code embeds a real-looking username/password pair as silent fallback credentials, with no runtime warning and no indication that they are test-only. This creates a high risk of unauthorized account use, secret leakage through source distribution, and accidental production dependence on embedded credentials.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-supplied place names are transmitted to third-party geocoding services without any explicit user-facing warning or consent in this file. Even if the query looks harmless, place names may reveal sensitive operational, personal, or commercial interests, and silent transmission undermines privacy expectations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: rasterio

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15