geoskill-soil-erosion-modeling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:00 PM UTC
• Version: 1.0.0

Overview

The main erosion model is local, but the package also includes undisclosed network, download, caching, and credential code, including hardcoded Earthdata credentials.

Review this package before installing in sensitive environments. The documented command appears to perform local RUSLE processing, but the package ships extra network and credential modules that are not explained by the skill description; remove or audit those modules, rotate the exposed Earthdata credentials, and pin dependencies before trusting it with private geospatial work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares an offline/local GeoTIFF workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. Even if some capabilities are legitimate for raster processing, the undeclared network and shell surfaces materially expand what the skill can do and reduce user ability to assess risk, especially given the privacy claims in the document.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as a local soil-erosion modeling tool, but analysis indicates unrelated geocoding, HTTP download logic, centralized credential handling for multiple external services, and even hardcoded Earthdata credentials. That combination is dangerous because it can conceal data exfiltration, unauthorized remote access, credential misuse, or supply-chain-style feature creep under an innocuous scientific workflow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata shows this skill bundles a different capability set than its declared purpose: a 'landsat-download' component with modules such as safe_download.py and credentials.py. That mismatch is dangerous because it expands the trusted attack surface with undeclared code paths, making it easier to hide unexpected data access, network activity, or future abuse inside a skill users would reasonably expect to be offline geospatial processing.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The metadata indicates inclusion of download and credential-handling modules that are not obviously required for a soil erosion modeling skill. Even without direct proof of misuse in this file, hidden network and credential capabilities increase risk because they could enable unexpected outbound access, secret handling, or data exfiltration in a context where users likely would not anticipate such behavior.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The AOI helper sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which expands the skill's behavior beyond purely local erosion modeling and can disclose potentially sensitive locations. In a geospatial workflow, AOIs may reveal private project sites, farms, or infrastructure locations, so undisclosed network exfiltration is a real security/privacy concern even if it appears functionally related.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The code caches query-derived AOI manifests under the user's home directory, creating persistent local records of locations the user searched for. While not an exploit by itself, this can leak sensitive operational or personal location data to other local users, backups, or forensic review when the skill description does not disclose such persistence.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly claims passwords are not hardcoded, yet the source embeds a default Earthdata username and password. Hardcoded credentials are dangerous because anyone with source access can reuse them, and downstream components may silently authenticate with shared secrets, causing account compromise, abuse, or accidental credential leakage.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation says passwords are not cached and are read on each call, but `load_user_secrets()` mutates module-level `_DEFAULTS` and reuses those values for the process lifetime. This inconsistency increases secret residency in memory and can mislead reviewers and operators about the actual exposure window for sensitive data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Place queries are transmitted to third-party geocoding services without any visible disclosure in this file, which creates a privacy and transparency issue. Because geospatial queries can encode sensitive user intent or exact project locations, silent transmission to external services is a legitimate security concern in this skill context.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The helper silently writes resolved queries to a cache file in the user's home directory, creating undisclosed persistent storage of location-related data. This is mainly a privacy risk rather than code execution, but it is still a real issue when users reasonably expect a modeling tool not to retain such history.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This code contains hardcoded fallback credentials in source and uses them silently if no environment variable or file-based secret is present. Silent fallback makes unintended use more likely, hides insecure configuration from operators, and exposes a reusable credential to anyone who can read the repository or package.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The Nominatim request hard-codes the Accept-Language header to Chinese, overriding user or environment preferences without opt-in. This can leak locale assumptions, reduce transparency, and produce biased or unexpected results for non-Chinese users, especially in a skill whose metadata does not justify forcing a specific locale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15