geoskill-snow-ice-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:59 PM UTC
• Version: 1.0.0

Overview

The main snow/ice mapping tool is mostly local and coherent, but the package includes under-disclosed credential, geocoding, download, and cache helpers that go beyond the documented offline purpose.

Review this before installing if you run skills in an environment with API keys, .netrc files, or sensitive location queries. The entrypoint appears to process local/synthetic raster data, but the package should remove or clearly document the credential broker, hardcoded Earthdata fallback, geocoding network calls, and home-directory cache before being treated as a routine offline skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its documented or inferred capabilities include shell, network, file read/write, and environment access. This is dangerous because users and orchestration systems cannot accurately assess what the skill may access or do at runtime, increasing the risk of unintended data exposure, command execution, or outbound communication without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow remote-sensing analysis, but the finding indicates additional generic capabilities including arbitrary URL downloading, place-name geocoding, credential harvesting from env and local secret stores, and even embedded default Earthdata credentials. This mismatch is dangerous because it hides sensitive behaviors behind an innocuous geospatial skill, enabling secret exposure, unauthorized network access, and abuse of bundled credentials far beyond the stated task context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module provides broad credential discovery and retrieval capabilities that exceed the stated snow/ice mapping purpose, including access to multiple unrelated services from environment variables, user secrets, and .netrc files. In a skill context, this expands the blast radius substantially: any downstream code in the skill package can silently obtain sensitive credentials that are not needed for NDSI-based snow extraction.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Support for reading an OPENAI_API_KEY is not justified by the declared snow/ice mapping functionality and creates unnecessary access to a high-value secret. Even though this file does not transmit the key itself, exposing a helper that retrieves it enables other code in the skill to consume or exfiltrate the credential.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module can retrieve FIRMS and EOG credentials even though those services are not directly tied to the stated snow/ice extraction task. This unnecessary capability increases the chance that unrelated user credentials stored in the environment, .netrc, or secrets file are accessed by the skill.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The file sends user-supplied place names to third-party geocoding services over the network, creating an undeclared outbound data flow. In the context of a snow/ice-mapping skill, this is more sensitive because users may expect local raster processing rather than transmission of AOI queries to external providers, creating privacy, compliance, and SSRF-like egress-governance concerns even though the destinations are hard-coded.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: Place queries are transmitted to third-party geocoding services without any in-code disclosure, opt-in, or privacy guardrails. In this skill context, user-supplied place names can reveal sensitive operational locations, and silent transmission to external services creates a real privacy and data-governance risk even if there is no obvious malicious intent.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The code silently stores geocoding results in a persistent cache under the user's home directory, which can leave a recoverable history of queried locations. In a geospatial workflow, AOI names and derived metadata may be sensitive, so undisclosed local persistence increases privacy and forensic exposure on shared or managed systems.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file hardcodes a real-looking Earthdata username and password as fallback defaults. Hardcoded credentials are dangerous because they may expose an actual account, encourage unsafe reuse, and cause silent authentication with embedded secrets whenever users have not explicitly configured credentials.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio

• Confidence: 95% confidence
• Finding: rasterio

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15