geoskill-service-area-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:53 PM UTC
• Version: 1.0.0

Overview

The main tool appears to do local service-area analysis, but the package also includes under-disclosed network and credential-handling code.

Review before installing. The service-area CLI itself appears local, but the package should remove or clearly disclose the bundled geocoding, download, home-directory cache, and credential-discovery helpers. The hardcoded Earthdata credentials should be removed and rotated, and dependencies should be pinned.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares an offline/local geospatial analysis purpose, but the detected capabilities include network, shell, environment access, and file read/write without any corresponding permission declaration or documentation. This creates an unnecessary trust gap: users may run the skill assuming limited local processing while it may access local secrets, invoke shell commands, or communicate externally if the implementation differs from the README.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: the skill is presented as an offline service-area analysis tool, yet the detected behavior reportedly includes online geocoding/weather services, generic HTTP download, credential handling from env/.netrc/secrets files, and even embedded default Earthdata credentials. Hidden network and credential functionality materially expands the attack surface and could lead to data exfiltration, unauthorized outbound access, or secret misuse under the guise of a harmless local GIS workflow.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The vendored core metadata claims the package belongs to a different skill ('landsat-download') than the stated service-area analysis skill. This indicates a supply-chain integrity or packaging mismatch: reviewers and automation can no longer reliably tell whether the bundled core files were sourced for this skill, increasing the risk of accidental reuse of the wrong codebase or deliberate substitution of a different component.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends user-provided place queries to third-party geocoding services (Open-Meteo and Nominatim). In a skill advertised mainly for service-area/GeoJSON analysis, this creates an undeclared data egress path that can leak sensitive or proprietary locations to external providers.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This credential module is over-scoped for a service-area analysis skill: it can retrieve credentials for multiple unrelated services, including OpenAI, CMA, FIRMS, and EOG. Broad credential access increases the blast radius if the skill or its dependencies are misused, because code associated with a narrowly described geospatial task can unexpectedly access additional secrets.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Support for OPENAI_API_KEY is not justified by the declared service-area analysis purpose and creates unnecessary secret exposure. Even without immediate exfiltration in this file, adding access paths to unrelated API keys expands the set of sensitive data the skill can touch.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The module advertises and supports multiple remote-sensing, weather, and data-service credential domains that are broader than the stated network service-area analysis functionality. This violates least privilege and may surprise users by allowing a single skill to access credentials for many external systems.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The docstring claims passwords are not hardcoded, yet the module contains literal fallback Earthdata credentials in source. Hardcoded credentials are a severe secret-management failure: anyone with source access can recover them, and they may be reused elsewhere or abused to access third-party services.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The legacy fallback makes outbound requests to third-party geocoding providers, which expands data flow beyond the stated service-area analysis scope and may send user-supplied place queries off-platform without clear disclosure. This becomes more dangerous because the fallback activates automatically on core import/runtime failure, so external network behavior can occur unexpectedly and bypass operator assumptions about the skill's dependencies.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User geocoding queries are transmitted to external services without any disclosure or consent mechanism in the code path. Place names can encode sensitive facilities, home/work locations, or customer sites, so silent transmission creates a privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The module persistently writes resolved queries to a cache directory under the user's home folder without disclosure. Those cache files can reveal searched locations and derived AOI data to other local processes, backups, or administrators, especially on shared systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Literal fallback credentials are embedded directly in the codebase without adequate protective controls. If this repository is shared, cloned, logged, or indexed, the credentials can be harvested and used without needing local system access.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 81% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 81% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 79% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15