geoskill-spatial-data-validation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:06 PM UTC
• Version: 1.0.0

Overview

The main validation command is local and coherent, but the package quietly includes unrelated network, downloader, geocoding, credential-reading, and hardcoded-credential helpers that are not disclosed by the skill description.

Treat this as requiring review before installation. The advertised CLI appears usable for local vector validation, but install it only if you are comfortable with the bundled extra modules that can read local credential stores, use hardcoded fallback credentials, send place queries to third-party geocoding services, cache location lookups under the home directory, and download arbitrary URLs if invoked by an agent or user.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (47)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises only offline spatial validation, but static analysis detected capabilities for environment access, file read/write, shell execution, and network use without any declared permissions or documentation. This creates a trust and review gap: operators may run the skill with broader access than expected, enabling data exfiltration, command execution, or unintended filesystem changes if the implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform local vector-data QA, but analysis indicates hidden geocoding, downloading, credential handling, remote-sensing helpers, and even embedded default credentials. Such concealed functionality is dangerous because users may supply sensitive geospatial data believing processing is offline, while the code may initiate network activity, consume secrets, or access third-party services beyond the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The vendored metadata declares a different embedded skill, 'landsat-download', which is inconsistent with the advertised purpose of vector spatial-data validation. That mismatch is dangerous because it signals hidden or unnecessary functionality, including download-related behavior, increasing the chance of unexpected network access, data exfiltration, or execution paths outside the declared trust boundary.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Download and credential-management modules are not justified by a skill whose stated function is offline geometry, topology, attribute, and CRS validation. In this context, those capabilities expand the attack surface by enabling secret handling and remote retrieval that could be abused for credential misuse, unauthorized outbound access, or covert data movement.

Context-Inappropriate Capability

High

• Confidence: 79% confidence
• Finding: The file sends user-supplied place queries to third-party geocoding services over the network without any visible consent flow or clear privacy boundary in this component. In the context of a vector data validation skill, this capability is unnecessary enough that it creates a meaningful data-exposure risk if users provide sensitive AOI names, project locations, or internal place references.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The code persists geocoding results under the user's home directory by default, which can leave a recoverable record of queried locations. In this skill context, storing AOI/location metadata locally is not clearly required for validation and may expose sensitive operational or personal geographic information to other local users, backups, or forensic review.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: This module manages credentials for multiple remote services that are unrelated to the stated purpose of local vector geometry/attribute/CRS validation. The mismatch expands the skill's trust boundary and creates unnecessary secret-handling capability, which is especially concerning because the same file also contains hardcoded fallback credentials and routines to harvest user secrets from environment variables, ~/.netrc, and ~/.geoskill/secrets.json.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code explicitly loads sensitive credentials from environment variables, ~/.netrc, and a user secrets file even though the skill description indicates a local data-validation function. Unnecessary secret access is dangerous because any downstream code path in the skill can silently obtain reusable credentials for external services, increasing the blast radius of compromise or abuse.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring states that passwords are not cached, but load_user_secrets() copies secrets into the process-wide _DEFAULTS dictionary and leaves them resident in memory. This discrepancy can mislead reviewers and operators into underestimating exposure in long-lived processes, debugging sessions, or memory dumps.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file implements a full-featured generic downloader with retry, resume, arbitrary URL fetching, file writing, and batch download support, which materially exceeds the stated purpose of a spatial data validation/reporting skill. In an agent context, this creates an unexpected capability to retrieve and persist attacker-controlled content, expanding the attack surface for data exfiltration, staging malicious payloads, SSRF against internal services, or bypassing intended skill scope controls.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The HTTP helper provides unrestricted outbound network access for arbitrary URLs via requests/urllib, despite the skill being described as a vector data validation tool. In this context, generic download primitives are dangerous because they can be repurposed to access internal endpoints, download untrusted files for later processing, or act as a covert network pivot unrelated to geometry/CRS validation.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The public API exposes place-name resolution and passes through options like user_agent, allow_nominatim, and caching, which expands the skill beyond its declared purpose of offline/structural vector-data validation. In a validation skill, unexpected geocoding introduces unnecessary external data flows and can cause user-supplied place names or derived AOI queries to be sent to third-party services without clear need or consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The legacy implementation performs direct outbound HTTP requests to Open-Meteo and Nominatim, creating network egress from a skill whose stated role is spatial-data quality validation. This can leak sensitive user inputs, create compliance/privacy issues, and provide a hidden exfiltration or tracking channel if the skill is run in environments expecting local-only validation behavior.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: User-provided place names are transmitted to external services without any user-facing disclosure in this module, creating a privacy and data-handling weakness. In a skill advertised for vector data validation, users are less likely to expect outbound transmission of geographic identifiers, which makes the behavior more dangerous from a trust and confidentiality perspective.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Writing geocoding results to a cache file in the user's home directory without warning can silently retain sensitive location queries and derived AOI metadata. This is especially problematic because the skill's stated purpose does not strongly imply persistent storage of potentially sensitive geographic inputs.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file hardcodes fallback credentials, including a cleartext EARTHDATA username and password, in source code. Hardcoded credentials are extremely dangerous because they can be extracted from the repository, reused by anyone with code access, and silently used in production without the operator realizing the skill is authenticating to an external service.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: Forcing the Accept-Language header to zh-CN/zh without user choice is an unjustified request-side policy that can bias responses, reveal assumptions about target users, and create privacy or profiling concerns. In the context of an unrelated validation skill, this makes the hidden network behavior more suspicious because it adds localization behavior not required for vector-data quality checks.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 95% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15