geoskill-solar-radiation-modeling

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:03 PM UTC
• Version: 1.0.0

Overview

The main solar-radiation tool looks offline, but the package also includes undisclosed network and credential-handling code that does not fit the stated purpose.

Review before installing. Use only the documented main entrypoint with explicit --bbox or --input if you proceed, and do not provide local secrets or API keys to this package unless the publisher removes or clearly documents the bundled geocoding, downloader, and credential modules. The hardcoded Earthdata credentials should be removed and rotated by the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares an offline, local-only solar radiation modeling workflow, yet static analysis detected capabilities for environment access, file read/write, shell, and network without any declared permissions. This creates a trust and sandboxing gap: users and policy engines cannot accurately assess or restrict what the skill may access, increasing the risk of unintended data exposure or command/network side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: the skill claims to perform local solar radiation modeling, but analysis indicates hidden geocoding, HTTP downloading, credential harvesting from env/.netrc/secrets, and even hardcoded Earthdata fallback credentials. Undisclosed credential access and network behavior are especially dangerous because they can exfiltrate sensitive data, violate least privilege, and materially expand the attack surface far beyond the stated scientific purpose.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata declares inclusion of a 'landsat-download' component in a skill whose stated purpose is solar radiation modeling, creating a clear capability-to-purpose mismatch. Even without source code here, bundling download, AOI, sensor, and credential-related modules expands the attack surface and may enable undeclared network access or data handling that users would not reasonably expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The metadata shows modules such as safe_download.py and credentials.py, indicating download and secret-handling capability that is not justified by the declared offline geospatial modeling purpose. In this context, hidden acquisition or credential features are risky because they can facilitate unexpected external communication, secret use, or data exfiltration under the guise of a modeling skill.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The antimeridian validation is inconsistent with its stated purpose: it flags only out-of-range longitudes, but not normalized wrap-around bboxes where W > E (for example, 170 to -170). In a geospatial modeling skill, this can cause dateline-crossing extents to be rejected incorrectly or handled without the special wrap-around logic the comments claim is required, leading to silently wrong area, clipping, or raster generation results.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module-level contract says scale/offset must be explicitly enforced, but full_raster_check only validates them when callers already provide values. That gap weakens an advertised safety check and can allow products with missing scale/offset metadata to pass validation, causing downstream consumers to misinterpret physical values such as solar radiation intensity.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This file implements a fully generic HTTP download primitive with retry, resume, and batch download capabilities that are broader than the declared solar-radiation modeling purpose. While not intrinsically malicious, such reusable network-fetch functionality expands the skill's attack surface and can enable retrieval of arbitrary remote content, including untrusted data or secondary payloads, if exposed to user-controlled URLs.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The batch helper accepts arbitrary item URLs and filenames and writes them into an output directory, making it a generic reusable remote file acquisition mechanism rather than a narrowly scoped modeling component. In the context of a geospatial modeling skill, this mismatch increases the risk of misuse for fetching unexpected external content and storing it locally under attacker-influenced names.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file adds network-based place resolution and fallback logic that is not clearly required by the stated solar-radiation raster modeling purpose. In an agent skill, hidden or weakly-justified external lookup behavior expands the attack surface by enabling outbound requests, data exfiltration of user-supplied locations, and capability drift beyond the declared function.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The legacy resolver performs external requests to Open-Meteo and optionally Nominatim using user-controlled place strings, which is an undeclared external capability relative to the stated modeling purpose. Even if not overtly malicious, this can leak sensitive location queries to third parties and creates reliability and policy risks from network dependence and fallback behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: User-supplied place names are sent to third-party geocoding services without any disclosure or consent mechanism in this code. Even if place names seem low sensitivity, they can reveal user interests, project locations, or operational areas, and the solar-radiation skill context does not by itself justify silent transmission to external parties.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes fallback Earthdata credentials directly in source code, including a plaintext username and password. Hardcoded secrets are dangerous because anyone with repository or package access can recover and reuse them, and downstream users may unknowingly authenticate with shared credentials that can be abused, revoked, or attributed to the wrong party.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Forcing the Accept-Language header to zh-CN for all Nominatim queries imposes a locale choice without user opt-in and can alter returned names or administrative interpretations. This is primarily a privacy, correctness, and transparency issue rather than a direct code-execution risk, but it is more concerning here because the skill already performs external location lookups unrelated to the narrow stated purpose.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 94% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15