geoskill-snow-avalanche-susceptibility

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:55 PM UTC
• Version: 1.0.0

Overview

The advertised avalanche tool is mostly local, but the package also ships undisclosed credential, geocoding, cache, and download helpers that do not fit the offline-only purpose.

Review this skill before installing. The main avalanche CLI appears to run locally, but the package contains extra helper code that can access credentials, use network geocoding/downloads, and write home-directory cache files. Install only if you are comfortable with those bundled modules or can remove/disable them and the hardcoded credentials first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill manifest claims an offline, local geospatial analysis workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions or user-facing disclosure. This undermines the trust boundary for the skill because users cannot accurately assess what resources the skill may access, and hidden capability expansion can enable data exfiltration, unexpected command execution, or broader filesystem access if the implementation uses those features.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a significant description-behavior mismatch: the skill is presented as a snow-avalanche susceptibility tool, but the analyzed behavior includes online geocoding, weather-service access, caching, a generalized downloader, credential management, and even hardcoded NASA Earthdata fallback credentials. In context, this makes the skill substantially more dangerous because users are told processing is local and offline, while the implementation appears capable of network access, credential use, and data retrieval beyond the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata claims the bundled core came from a different skill ('landsat-download') than the actual avalanche-assessment skill. This is a supply-chain integrity problem because provenance metadata may be relied on during review, auditing, or update workflows; a mismatch can hide accidental mix-ups or unauthorized code reuse. In this context, the file is specifically meant to attest vendored origin and hashes, so incorrect identity makes the discrepancy more dangerous rather than less.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module centralizes access to a broad set of credentials and secret sources that are not clearly required for a snow-avalanche susceptibility skill. In this skill context, adding generalized secret-access capability increases the blast radius: any downstream code in the skill can retrieve unrelated credentials from environment variables, ~/.netrc, or ~/.geoskill/secrets.json, enabling credential harvesting or misuse beyond the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module exposes helper access to OPENAI_API_KEY even though this file's stated domain is geospatial avalanche susceptibility analysis, not LLM API use. In context, unnecessary access to an LLM credential is dangerous because it creates an unjustified path for secret retrieval and possible off-platform data exfiltration if later code uses that key.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module also supports EOG account credentials, which are not obviously relevant to avalanche susceptibility modeling from the provided skill description. Unnecessary credential support widens the attack surface by allowing this skill code to read and potentially misuse unrelated user secrets from env, .netrc, or the user secrets file.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module claims it does not cache passwords, but load_user_secrets() loads secrets into the process-global _DEFAULTS dictionary and keeps them resident for the lifetime of the process. That increases the exposure window for sensitive data in memory and contradicts the stated security model, making reviewers and users underestimate the persistence of secrets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-provided place names are sent to third-party geocoding services without any disclosure or consent mechanism in this module. Even if queries are not highly sensitive in many cases, location searches can reveal user interests, work sites, travel plans, or sensitive geographic targets, making this a real privacy/security issue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module persists resolved queries to a cache file in the user's home directory without explicit disclosure or retention controls. Cached place names can expose sensitive locations to other local users, backup systems, or forensic review, especially on shared or managed machines.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback Earthdata credentials with a real-looking username and password. Hardcoded credentials are dangerous because they may be valid shared secrets, can be extracted by anyone with code access, and normalize unsafe secret distribution; in this skill context they are especially suspicious because they enable network-authenticated access unrelated users did not explicitly configure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends raw user-provided place queries to third-party geocoding services via HTTP requests without any user-facing disclosure or consent mechanism in this file. Even if sent over HTTPS, place names can contain sensitive location intent, so silent transmission to external providers creates a privacy and data-governance risk in an analysis skill context.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Forcing the Accept-Language header to zh-CN influences how third-party providers process and log requests, and may unexpectedly steer results or leak inferred user locale/preferences without consent. While not a severe exploit path, hard-coding locale behavior without opt-in is a privacy and correctness concern, especially for a broadly usable geospatial skill.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 82% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 80% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15