geoskill-spatial-etl-pipeline

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:06 PM UTC
• Version: 1.0.0

Overview

The advertised ETL tool is mostly local, but the package includes undisclosed credential handling, a hardcoded Earthdata password, and optional network geocoding that conflicts with its offline privacy claims.

Review carefully before installing. The local ETL entrypoint is limited, but the package should remove or clearly document the credential, geocoding, cache, and download helpers; rotate the exposed Earthdata password; and pin dependencies before use in sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares an offline, local ETL workflow, yet static analysis detected capabilities for environment access, file read/write, network, and shell without any explicit permission declaration. That gap reduces transparency and can hide risky behavior from users, especially because config-driven pipelines and file inputs can be extended to touch sensitive local data or invoke external resources unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This finding indicates the implementation behavior materially exceeds the stated purpose: beyond local spatial ETL, it apparently includes embedded external-service credentials, web geocoding, downloading, and remote-sensing helper logic. Hidden credential handling and undeclared networked behaviors are dangerous because they can expose secrets, enable silent outbound data transfer, and mislead users into trusting a supposedly offline/local skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This module sends user-supplied place queries to third-party geocoding services (Open-Meteo and Nominatim), which is a real data-exposure behavior not obvious from the ETL-oriented skill description alone. In a spatial ETL context, place names can contain sensitive operational, customer, or investigative targets, so silent outbound requests expand the trust boundary and may violate privacy or deployment assumptions.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The docstring claims ambiguous inputs will return candidates instead of silently taking the first match, but the implementation still sorts candidates and auto-selects one. That mismatch can cause data integrity and safety issues in ETL pipelines, because users may believe ambiguity is preserved while the code actually resolves to a potentially wrong AOI and continues processing.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module exposes retrieval of an OPENAI_API_KEY even though the stated skill purpose is a spatial ETL pipeline. Expanding the credential surface to unrelated providers increases the chance that downstream code can access and exfiltrate a high-value API secret without a need tied to the skill’s core function.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring states passwords are not cached, but load_user_secrets copies secret values into the module-global _DEFAULTS dict and retains them for the process lifetime. This creates misleading security guarantees and increases exposure in long-lived processes, memory inspection, crash dumps, or accidental debug output.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The legacy resolver makes direct outbound requests to third-party geocoding services using user-supplied place strings. In an ETL pipeline context, this can exfiltrate potentially sensitive location queries, create undocumented data flows to external services, and introduce compliance and operational risk if users assume processing is local or internal.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Sending geocoding queries to external services without clear disclosure is a genuine privacy/security issue because user input leaves the local environment and becomes visible to third parties. In an ETL pipeline, AOI names may reveal confidential projects, customer locations, or internal analysis targets, making silent exfiltration through normal functionality materially risky.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code writes resolved queries and AOI manifests to a cache directory under the user's home directory without disclosure or consent. Local disk caching can expose sensitive place names and derived locations to other local users, backups, forensic collection, or shared workstation environments, especially because there is no retention, permission hardening, or encryption.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 100% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 94% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
geopandas
shapely
fiona
pyproj

• Confidence: 98% confidence
• Finding: fiona

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geopandas
shapely
fiona
pyproj

• Confidence: 95% confidence
• Finding: pyproj

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: numpy

Known Vulnerable Dependency: geopandas — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: geopandas

Known Vulnerable Dependency: fiona — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: fiona

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15