Geoskill: Soilgrids Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:10 AM UTC
• Version: 5.0.1

Overview

The skill largely matches its SoilGrids download purpose, but it ships unrelated credential-handling code with hardcoded Earthdata credentials and under-disclosed geocoding/privacy behavior.

Review this skill before installing. The SoilGrids CLI itself appears to perform normal data queries and write requested CSV/JSON outputs, but the package includes unrelated credential utilities with a hardcoded Earthdata password and reads local credential stores. Avoid using it in an environment with sensitive ~/.netrc or ~/.geoskill/secrets.json files unless you trust the publisher and have removed or isolated that credential code. Also note that using --place sends the place name to third-party geocoding services, despite incomplete privacy disclosure.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring states the function applies a WGS84 ellipsoidal formula with spherical approximation plus ellipsoidal correction, but the implementation uses only a simple spherical trapezoid-area calculation with radius WGS84_A. In a geospatial validation module that claims to enforce scientific correctness, this mismatch can cause downstream users to trust area values as more accurate than they are, leading to incorrect thresholds, reporting, or decision-making.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module-level policy says antimeridian-crossing bounding boxes must be rejected unless specially handled, but check_bbox_wgs84 only flags values outside [-180,180] and otherwise treats w >= e generically. As a result, valid wraparound cases such as W=170, E=-170 are not specifically identified as antimeridian crossings, and callers may mis-handle them as invalid ordering or fail to apply required wraparound logic, causing incorrect area/extent calculations and potential data corruption.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly claims passwords are not hardcoded in source, yet `_DEFAULTS` contains a real-looking Earthdata username and password. Hardcoded credentials are dangerous because anyone with source access can reuse them, and the misleading documentation may cause reviewers to miss the exposure.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docs say passwords are not cached and are read on each call, but `load_user_secrets()` copies secrets into `_DEFAULTS` and keeps them in process memory behind `_user_secrets_loaded`. This inconsistency increases the risk of secret retention in long-lived processes, memory dumps, debugging sessions, or unintended reuse after the source file changes.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The privacy notice is materially inaccurate: when --place is used, the script sends the user-supplied place query and related request metadata to Nominatim endpoints in addition to SoilGrids. This can mislead users about what data leaves the system and which third parties receive it, undermining informed consent and potentially violating privacy or compliance expectations.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The resolver sends user-supplied place queries to external geocoding services and persists results to a cache directory under the user's home directory without any explicit user-facing disclosure or consent mechanism. In a skill context, place names can contain sensitive location information, so silent network transmission and local persistence can leak private data to third parties or other local users/processes.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code includes hardcoded fallback credentials without any strong runtime warning, opt-in gate, or immediate failure path. In a credential-management module, this is especially dangerous because downstream callers may unknowingly authenticate with shared or exposed credentials, creating account compromise, audit ambiguity, and accidental production use.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The code hard-codes Accept-Language to a Chinese locale for Nominatim requests without user awareness or control. While not a direct code-execution issue, it can alter returned results and unnecessarily reveal a locale preference that may not reflect the user's intent, creating minor privacy and integrity concerns.

Ssd 3

High

• Confidence: 85% confidence
• Finding: The module centralizes acquisition and source-reporting of sensitive credentials, and also stores loaded user secrets in `_DEFAULTS`. While central credential helpers can be legitimate, this implementation increases exposure by normalizing process-wide retention and making secret availability discoverable, which is more sensitive in a shared skill/runtime context.

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 77% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 84% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
soilgrids_download
tqdm>=4.64.0

• Confidence: 96% confidence
• Finding: soilgrids_download

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
soilgrids_download
tqdm>=4.64.0

• Confidence: 98% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
soilgrids_download
tqdm>=4.64.0

• Confidence: 93% confidence
• Finding: tqdm>=4.64.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: requests==2.28.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: tqdm==4.64.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_soilgrids-download.py:27