geoskill-spatial-data-dashboard

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:03 PM UTC
• Version: 1.0.0

Overview

The dashboard entrypoint mostly performs local GIS processing, but the package also ships under-disclosed credential, download, caching, and network behavior that does not fit the stated offline dashboard purpose.

Treat this as a Review item before installing. The main dashboard command appears local and bounded, but the package should not be used in sensitive environments unless the hardcoded credentials are removed, the credential/downloader helpers are justified or stripped, and the documentation clearly states the browser-side network requests and any geocoding/cache behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill documentation declares an offline/local dashboard generator, but the detected capabilities include network, shell, environment access, and file read/write without any explicit permission declaration. This creates a trust and review gap: users may invoke a skill believing it is low-risk when it can access local files, execute commands, or reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a local spatial dashboard builder, but the finding indicates substantially broader behavior including online geocoding, remote downloads, disk caching in the user's home directory, secret discovery from environment and credential files, and even embedded default Earthdata credentials. This mismatch is dangerous because it can lead to unintended data exfiltration, credential exposure, and unauthorized network activity under the guise of an offline visualization tool.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata identifies a component for 'landsat-download', which is materially different from the declared purpose of building spatial dashboards into HTML. Capability/purpose mismatches are dangerous because they can conceal undeclared data acquisition behavior, expand the attack surface, and make reviewers miss code paths unrelated to the advertised function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The presence of vendored files such as safe_download.py and credentials.py introduces network retrieval and secret-handling capabilities that are not clearly aligned with a dashboard-generation skill. In this context, undeclared download and credential logic is especially risky because it could enable unexpected external access, data exfiltration, or secret misuse under the guise of a benign visualization tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module sends user-supplied place names to third-party geocoding services (Open-Meteo and Nominatim). In a dashboard-building skill, this is a real data-flow and capability expansion beyond purely local rendering, creating privacy and data-governance risk if users assume AOI resolution is offline or internal.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module persists cache files containing resolved queries under the user's home directory without being implied by the skill description. Even if the data is not highly sensitive by itself, place queries can reveal interests, locations, projects, or operational focus, and persistence increases exposure beyond a single run.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This module materially exceeds the stated purpose of building spatial HTML dashboards by implementing broad credential discovery and retrieval from environment variables, user home secrets, and netrc files. In an agent-skill context, this expands the skill’s access to sensitive local secrets and increases the blast radius if other code paths invoke these helpers unnecessarily or abusively.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code exposes a helper for retrieving OPENAI_API_KEY despite the skill being described as an HTML spatial dashboard builder. Access to unrelated API credentials is dangerous in agent settings because it creates an unnecessary path to sensitive secrets that could later be used by other components or prompt-influenced logic.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module reads from ~/.geoskill/secrets.json and ~/.netrc/_netrc, which goes beyond the expected needs of a dashboard-building skill and reaches into general user secret stores. In this context, that broader secret-harvesting capability increases risk because the skill can inspect sensitive local credential sources unrelated to its primary function.

Intent-Code Divergence

Low

• Confidence: 72% confidence
• Finding: The docstring states that passwords are not cached, but load_user_secrets() copies secret values into the module-level _DEFAULTS dictionary and retains them in memory. This discrepancy is dangerous because it misleads reviewers and users about secret lifetime, potentially weakening operational safeguards in long-lived processes.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The generated dashboard is not actually self-contained or fully offline: it loads Leaflet JS/CSS from unpkg.com and map tiles from openstreetmap.org at browser runtime. This creates privacy, integrity, and availability risk because opening the HTML leaks user IP/usage metadata to third parties and makes the dashboard dependent on external network resources despite claims of offline/local processing.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The documentation materially understates runtime network dependencies by describing the dashboard as self-contained and offline while the HTML still pulls external browser-side resources. Misleading security/privacy claims can cause users to open supposedly offline artifacts in sensitive environments, unintentionally disclosing access metadata or failing in air-gapped settings.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-entered place queries are transmitted to external services without any warning in this file. That can leak potentially sensitive location intent or business context to third parties, especially in enterprise or regulated environments where users may expect local-only processing.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Resolved place queries are written to persistent cache files in the user's home directory without user-facing notice. This creates silent retention of potentially sensitive geographic interests and can expose them to other local users, backups, forensic review, or later unintended reuse.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a concrete Earthdata username and password in source code. Hardcoded credentials are highly dangerous because anyone with code access can reuse them, and they may be unintentionally propagated into packages, forks, backups, or logs.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 81% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 81% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 79% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 80% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 85% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 76% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15