Geoskill: STAC Search

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:11 AM UTC
• Version: 5.0.1

Overview

The skill mostly behaves like a STAC search tool, but it ships under-disclosed credential-handling code with hardcoded login credentials and extra network/location lookup behavior.

Review this skill before installing. Remove and rotate the embedded Earthdata credentials, require users to provide their own credentials explicitly, document all external geocoding providers and local files written, and constrain the requests dependency to a reviewed patched version.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The documented purpose is a simple STAC search utility, but the associated behavior reportedly includes credential management for multiple services, hardcoded fallback credentials, downloads, geocoding, local caching, and writing files. This mismatch is dangerous because it can conceal materially broader capabilities than users expect, including secret handling and outbound network activity, reducing informed consent and increasing the chance of misuse or data exposure.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring states the area calculation uses a spherical approximation plus ellipsoidal correction, but the implementation uses only a simple spherical formula with WGS84_A as radius. In geospatial workflows, this can silently produce incorrect area values that downstream logic may trust for filtering, billing, quota enforcement, or scientific decisions, creating integrity risk rather than code-execution risk. The skill context makes this somewhat more concerning because the file is explicitly framed as enforcing scientific correctness checks.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation claims passwords are not cached, but load_user_secrets() copies secret values into the module-global _DEFAULTS and retains them for the process lifetime. This mismatch can cause operators to underestimate in-memory secret exposure, increasing risk from memory inspection, debug dumps, or accidental reuse across contexts.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The resolver performs a network-based fallback to external geocoding when a place is not in the local hardcoded map. That expands the skill's behavior beyond local STAC query construction and can disclose user-supplied place names to a third party without any explicit consent, configuration gate, or audit trail in this file.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code enables external geocoding capability via `_geoskill_aoi.resolve_place(... allow_nominatim=True ...)`, which is not obviously necessary for a STAC search helper and introduces undeclared outbound data flow. Even if the queried data is only a place string, this still changes the trust boundary and may violate least-privilege expectations for the skill.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The privacy disclosure states that only search queries are sent to public STAC endpoints and that no other data are transmitted, but the --place help text indicates use of Nominatim for place resolution. That means user-supplied place names may be sent to an additional third-party service, creating a misleading disclosure and a privacy risk for sensitive geographic queries.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The resolver sends user-supplied place queries to third-party geocoding services (Open-Meteo and optionally Nominatim), which can expose sensitive locations or search intent without explicit disclosure. In a geospatial search skill, AOI/place strings may encode private home, facility, or operational locations, so this creates a meaningful privacy and data-sharing risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module persistently stores resolved query data under the user's home directory by default, which can leave a local history of sensitive place lookups. On shared systems or managed environments, this may reveal user intent, locations of interest, or operational context to other local users, backup systems, or incident responders.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The source contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Hardcoded secrets in source are a serious exposure because anyone with repository or package access can recover and misuse them, and downstream users may unknowingly authenticate with shared credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-controlled `place` input can be sent to an online geocoder with `use_nominatim=True` by default, and this file provides no warning, consent mechanism, or indication to callers that external transmission may occur. This creates a privacy and policy risk because sensitive locations or investigative queries may be disclosed to a third-party service.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 98% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 94% confidence
• Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:12

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_format.py:19