geoskill-spatial-join-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 2:05 PM UTC
• Version: 1.0.0

Overview

The advertised spatial-join tool is mostly local at its main entrypoint, but the package also contains under-disclosed network, downloader, cache, and credential-handling code that does not fit the stated offline purpose.

Review carefully before installing. The main spatial-join script appears intended for local geospatial processing, but the package contains extra network, download, cache, and credential code that is not disclosed by the skill description. Do not install in environments where local credentials, .netrc files, OpenAI keys, Earthdata accounts, or sensitive place queries must be isolated unless the package is reduced to the spatial-join entrypoint and the extra modules are removed or clearly gated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill metadata declares an offline spatial-join utility, but the detected capabilities include environment access, file read/write, shell, and network without any corresponding permission declaration. This creates a trust-boundary failure: users may run the skill expecting only local geospatial processing while the implementation could access sensitive local data or external endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to perform local spatial relationship analysis, but the detected behavior includes remote requests, caching, credential handling, downloads, and even hardcoded credential fallback. Such hidden functionality can expose secrets, retrieve untrusted content, and cause users to execute a far more privileged workflow than they consented to.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored metadata shows the skill bundles a different core component, 'landsat-download', despite the declared purpose being spatial join analysis. This kind of capability mismatch expands the attack surface and can hide unexpected network, file, or data-access behavior that users would not reasonably expect from the skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Including credential-handling and download-related files in a spatial-analysis skill is unjustified and materially increases risk, because such modules can enable secret access, outbound data transfer, or retrieval of remote content. In this context, the mismatch is more dangerous because users expect local geospatial computation, not credential use or network-enabled behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module performs outbound geocoding requests to third-party services even though the stated skill purpose is spatial-join/relationship analysis. Hidden network egress can expose user-supplied locations to external providers and violates least surprise, which is materially relevant in agent skills handling potentially sensitive geographic queries.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code persists cache files under the user's home directory without any visible consent or retention controls in this file. Storing place queries on disk can leak sensitive location interests to other local users, backups, or forensic collection, especially in shared or managed environments.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Outbound HTTP requests send user-provided place names to Open-Meteo and optionally Nominatim, which is beyond the declared scope and creates a privacy-relevant data flow. In an agent setting, users may not realize that their geographic inputs are transmitted to third parties, making this a real disclosure risk.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This module is far broader than the stated spatial-join/aggregation purpose and centralizes access to multiple external-service credentials, including OpenAI, CMA, FIRMS, Earthdata, and EOG. In a skill whose advertised function is spatial relationship analysis, this expands privilege and data access unnecessarily, increasing the blast radius if the skill or any dependent code is abused.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The presence of `get_openai_key()` in a geospatial spatial-join skill indicates access to an unrelated high-value API credential without clear necessity. Even though this file does not exfiltrate the key itself, providing a retrieval path for unrelated secrets increases the chance that other code in the skill can silently leverage or leak it.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The docstring claims passwords are not hardcoded, but `_DEFAULTS` contains a literal Earthdata username and password. Hardcoded credentials in source control are a severe secret-management failure because anyone with repository access can recover and reuse them, and the credentials may propagate into forks, backups, or packaged artifacts.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documentation states passwords are not cached and are read on each call, but `load_user_secrets()` loads secrets into `_DEFAULTS` and reuses them for the process lifetime. This inconsistency can mislead auditors and users about the module's security properties, and long-lived in-memory retention increases exposure in crashes, debugging, or memory inspection scenarios.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The token helper claims support for reading an Earthdata token from the `.netrc` `account` field, but the implementation never parses or returns that field. This is primarily a security-relevant integrity issue: operators may believe token-based auth is in use while the code silently falls back to other sources, including defaults, which can weaken intended authentication handling.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The file introduces a reusable remote downloader with retry, resume, and file-write capabilities that are unrelated to the stated spatial-join and aggregation purpose. In a skill ecosystem, unexplained network-transfer primitives expand the attack surface by enabling data exfiltration, unreviewed payload retrieval, or staged behavior that is not apparent from the skill manifest.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This module provides general-purpose remote file download to arbitrary URLs and writes attacker-controlled content to disk, which is a powerful primitive when not tightly justified by the skill's purpose. Even with SHA256 support and size limits, the capability can be abused to fetch malicious data, enable covert outbound access, or support multi-stage behavior if callers supply untrusted URLs or paths.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The public API delegates place resolution to a geocoding component, introducing a capability outside the declared scope of spatial-join and aggregation analysis. Scope expansion matters because user-provided place names may trigger external lookups and data handling that operators would not expect from this skill, increasing privacy and supply-chain risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file performs outbound HTTP requests to Open-Meteo and Nominatim using user-supplied place queries, which is a material network capability not obviously required by the stated skill purpose. This can leak sensitive user input to third parties and create dependency on remote services that may be unavailable, altered, or monitored.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: User place queries are written to persistent cache files without any user-facing disclosure in this file. Location queries can be sensitive personal or business information, so silent persistence creates a privacy and data-handling risk even if the cache is intended only for performance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code transmits user-provided place data to an external geocoding service without any user-facing notice in this file. Silent third-party disclosure of geographic queries is dangerous because those queries may reveal private travel, residence, operational, or investigative interests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Fallback requests to Nominatim also send user-supplied place data to a third party without user-facing disclosure. Because this occurs as an automatic fallback, users may be unaware that failed primary resolution triggers additional external disclosure to another provider.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: User-provided place names are sent directly to external services without any notice in this file that queries leave the local environment. If users submit proprietary locations, incident addresses, or other sensitive geographic references, those inputs may be disclosed to third parties unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: geopandas

Unpinned Dependencies

Low

• Category: Supply Chain

Content

rasterio
scipy
geopandas
shapely

• Confidence: 98% confidence
• Finding: shapely

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15