geoskill-spatial-autocorrelation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:02 PM UTC
• Version: 1.0.0

Overview

The main tool looks like a local spatial analysis script, but the package also includes undocumented network, downloader, and credential-handling code that does not fit the stated offline purpose.

Review this skill before installing. Use the main CLI only for local analysis if you proceed, and do not rely on the package's offline privacy claim without removing or auditing the bundled geocoding, downloader, and credential modules. The hardcoded credentials should be removed and any exposed account rotated; dependencies should also be pinned to reviewed versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation declares an offline, local-only spatial analysis tool, yet the static analyzer detected capabilities for environment access, file read/write, shell, and network without any declared permissions. Even if some of these capabilities are legitimate for geospatial processing, failing to declare them hides the true attack surface and can cause reviewers or users to trust a skill that can access more resources than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform offline spatial autocorrelation analysis on local or synthetic data, but the analyzer reports geocoding, remote HTTP access, credential handling for multiple external services, hardcoded fallback secrets, and general-purpose downloading logic. That combination materially expands the risk from a local analytics skill to a network-capable data-fetching component that may leak data, misuse embedded credentials, or fetch untrusted content under false pretenses.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored metadata claims the embedded core came from the 'landsat-download' skill, while this package is presented as a spatial autocorrelation skill. This mismatch undermines software supply-chain integrity because reviewers and automation can no longer trust provenance, and it may indicate the wrong component was copied, mislabeled, or substituted without proper verification.

Description-Behavior Mismatch

Medium

• Confidence: 73% confidence
• Finding: The helper persists user place queries and resolved locations under the user's home directory without clear consent or retention controls in this file. Persistent local caching can expose sensitive search history or location interests to other local users, backups, or forensic review, especially on shared systems.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module claims it enforces rejection of antimeridian-crossing bounding boxes, but the implemented check only flags longitudes outside [-180, 180] and misses the common wrapped case where W > E within valid longitude bounds (for example 170 to -170). In a geospatial analysis skill, this can cause downstream area, extent, and spatial statistics computations to silently use invalid extents, producing materially incorrect scientific results.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The docstring states the function uses a WGS84 ellipsoidal formula with correction, but the implementation uses a spherical formula with radius WGS84_A only. In this spatial autocorrelation context, misleading scientific claims can propagate inaccurate area-derived thresholds or validations, especially over large extents or higher latitudes, undermining the correctness of analysis outputs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module is a centralized credential broker that exposes access to multiple external services, including ones not obviously required for a spatial autocorrelation skill. In this context, broad credential-handling capability expands the blast radius of the skill and creates unnecessary opportunities for data exfiltration or unauthorized outbound access if any downstream code misuses these helpers.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Support for OPENAI_API_KEY is unrelated to the declared purpose of spatial autocorrelation analysis and introduces an unnecessary secret into the skill's reachable surface. In a skill that should primarily perform local/statistical computation, access to an LLM API credential increases the risk of unintended external transmission and secret misuse.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module exposes credential access for FIRMS, CMA, and EOG services that are not justified by the stated scope of global Moran I/LISA/Gi* analysis. Even if not actively exfiltrating data, bundling unrelated remote-service credentials into a statistics skill violates least privilege and broadens the attack surface.

Intent-Code Divergence

Critical

• Confidence: 100% confidence
• Finding: The code hardcodes a real-looking Earthdata username and password in _DEFAULTS while the documentation claims credentials must not be hardcoded. Hardcoded fallback credentials are highly dangerous because they may be leaked via source distribution, copied into other environments, and silently used without user awareness, enabling unauthorized third-party account use.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The module performs outbound requests to third-party geocoding services using user-supplied place queries, which can leak potentially sensitive user input and create an undeclared external data flow. In a skill advertised for spatial autocorrelation analysis, this is more concerning because users may not expect network transmission of their locations or study areas to external providers.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Writing place queries to a persistent cache file without prominent disclosure creates a privacy-sensitive data trail of user-provided locations. In geospatial contexts, queried places may reveal travel, residence, operations, or research interests, so silent persistence increases exposure if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The resolver sends user-supplied place names to external geocoding services without any in-file disclosure or consent flow. That can leak sensitive location intents to third parties, which is especially relevant in an analytics skill where queried AOIs may correspond to proprietary, personal, or operationally sensitive areas.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module silently falls back to hardcoded credentials with no runtime disclosure, meaning operators may unknowingly authenticate as a bundled account. This obscures security-relevant behavior and can lead to unauthorized service usage, accidental account sharing, and difficult incident attribution.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The Nominatim request hard-codes an `Accept-Language` preference for `zh-CN`, forcing a locale choice without user consent. This can reveal assumptions about user region/language, produce unexpected localized results, and create privacy or policy concerns in contexts where localization should be user-driven or neutral.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 79% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 97% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 96% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 95% confidence
• Finding: shapely

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: scipy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: geopandas

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15