geoskill-smart-city-digital-twin

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:55 PM UTC
• Version: 1.0.0

Overview

The main tool looks like a local geospatial processor, but the package also includes undisclosed credential-handling and network-capable helper code, including a hardcoded Earthdata username and password.

Review before installing. The visible CLI appears to perform local DEM/DSM processing, but the package contains extra reusable core code with hardcoded credentials, local secret-store access, network geocoding, and persistent AOI caching that are not disclosed by the skill instructions. Do not use until the publisher removes hardcoded secrets, corrects provenance metadata, documents or removes network/credential helpers, and pins dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 67% confidence
• Finding: If the underlying skill code truly includes hardcoded credentials, credential retrieval for multiple external services, geocoding, remote downloads, and broad geospatial utility behavior that is not disclosed in the skill description, that is a meaningful security concern. Hidden authentication material and undeclared network-enabled functionality expand the attack surface, can leak secrets, and defeat user expectations about an offline local-processing skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the declared smart-city digital twin skill. This provenance mismatch undermines supply-chain traceability and can conceal accidental or unauthorized code reuse, making it harder to verify that the packaged core is the expected one.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback credentials, including a plaintext Earthdata username and password, directly in source. Any distributed copy of the skill exposes those secrets to anyone with repository or package access, enables unauthorized use of the external account, and contradicts the stated design goal of not hardcoding passwords.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring explicitly claims passwords are not hardcoded in skill source, yet the module contains hardcoded default Earthdata credentials. This kind of misleading documentation increases operational risk because reviewers and users may trust the module and overlook an actual embedded secret.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: User-supplied place queries are sent to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive location intent or operational context without explicit user awareness or consent. In a smart-city digital twin context, AOIs may reveal planning targets, infrastructure interests, or internal project locations, increasing privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Resolved location data is persisted under the user's home directory, creating a local privacy artifact that may expose queried places, project areas, or sensitive AOIs to other local users, backup systems, or forensic inspection. Because caching is enabled by default and silent, users may not realize that location intelligence is being retained on disk.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: Forcing the Accept-Language header to Chinese without user choice can leak locale assumptions and alter returned geocoding content in ways the user did not request. While lower impact than direct data exfiltration, it still creates avoidable privacy and policy issues by transmitting an unnecessary preference signal to an external service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can expose sensitive location queries to external providers without any built-in notice, consent flow, or minimization. In a smart-city digital twin context, place queries may reveal operationally sensitive sites, making this more than a purely theoretical privacy issue even though it is not directly a code-execution flaw.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN, which forces a locale preference without user choice or clear justification. This can leak assumptions about the user's region or deployment context and may bias returned metadata, creating unnecessary privacy and correctness concerns in a geospatial resolution component.

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
geopandas
shapely
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: geopandas

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15