geoskill-soil-moisture-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:01 PM UTC
• Version: 1.0.0

Overview

The main soil-moisture tool is locally focused, but the package includes under-disclosed helper code for credentials, arbitrary downloads, and geocoding, including plaintext fallback Earthdata credentials.

Review this before installing. The soil-moisture command itself appears purpose-aligned, but the package should remove and rotate the hardcoded Earthdata credentials, document or remove credential/geocoding/download helpers that are not needed by the CLI, constrain network downloads, and pin dependencies. Avoid relying on the bundled fallback account or placing personal secrets where this package can read them unless the publisher clarifies the credential workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet the analyzed behavior indicates access to environment variables, filesystem, shell execution, and network operations. This creates a transparency and trust problem: users and reviewers cannot accurately assess what the skill may access, increasing the chance of unintended data exposure or unsafe execution in permissive environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow, but the detected behavior includes broad networking, geocoding, generic download utilities, unrelated sensor registries, and credential handling for multiple third-party services, including hardcoded fallback credentials. This mismatch is dangerous because it conceals a much larger attack surface than users expect, enabling secret leakage, unauthorized external communication, and abuse of bundled credentials or local resources.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file implements a reusable arbitrary-URL downloader with resume, retries, and batch download support, which materially expands the skill’s capability beyond the stated soil-moisture estimation purpose. In a skill ecosystem, this creates a supply-chain and exfiltration/enabler risk because other code can use it to fetch unreviewed remote payloads or large datasets from attacker-controlled locations, especially since no allowlist, scheme restriction, or mandatory integrity verification is enforced.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback credentials, including a plaintext Earthdata username and password, directly in source. Hardcoded secrets are dangerous because anyone with repository or package access can recover and reuse them, and downstream users may unknowingly authenticate with shared credentials, causing account compromise, abuse attribution, and secret leakage into forks, caches, or artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header of zh-CN,zh;q=0.9 without user choice. This can cause privacy and policy issues by leaking language/locale assumptions to third parties and can bias or misroute geocoding results, which may lead to incorrect AOI selection and downstream analysis errors.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 73% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15