geoskill-strip-noise-removal

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:06 PM UTC
• Version: 1.0.0

Overview

The main destriping tool appears locally focused, but the package also ships under-disclosed geocoding, download, cache, and credential code that does not fit the advertised offline image-noise-removal purpose.

Install only after the publisher removes or clearly documents the unrelated geocoding/download/credential modules, removes and rotates the embedded Earthdata credentials, and pins or constrains dependencies. The documented destriping entrypoint itself looks local, but the shipped package is broader than the description.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions while analysis indicates capabilities for environment access, file read/write, networking, and shell execution. That mismatch undermines user consent and sandbox expectations, because a seemingly local raster-processing skill may access local data or external services without explicit disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose is offline destriping, but the detected behavior includes geocoding, HTTP downloads, credential management for multiple third-party services, and hardcoded fallback credentials. This is dangerous because the hidden breadth of functionality greatly expands the attack surface and may expose secrets or enable unauthorized network actions that users would not expect from an image-noise-removal skill.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata declares the core as belonging to a different skill ('landsat-download') than the actual destriping skill. This creates a supply-chain integrity problem: build, review, or provenance tooling may attribute files to the wrong component, making it easier for incorrect or unreviewed code to be shipped under misleading metadata. In a geospatial processing skill, this mismatch is not inherently code-execution by itself, but it weakens trust, auditability, and dependency verification.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file adds AOI geocoding, online lookup, and persistence behavior to a skill whose declared purpose is destriping/noise removal. Capability drift matters in agent skills because it expands data handling and network reach beyond user expectations, increasing privacy and supply-chain risk even if the code is not overtly malicious.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code performs outbound HTTP requests to third-party geocoding services using user-supplied place names, which is unrelated to the declared image noise-removal function. In an agent-skill setting, undeclared external communications can leak sensitive user intent, location of interest, or operational context to external providers.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This file contains hardcoded fallback credentials for an Earthdata account in source code. Embedding live-looking usernames and passwords in a credential manager creates immediate secret exposure risk, enables unauthorized account use by anyone with repository access, and normalizes insecure secret distribution.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The module implements place resolution and geocoding logic, including external network lookups, which does not align with the declared destriping-only skill purpose. In a skill ecosystem, this kind of capability drift is dangerous because it expands data handling and network behavior beyond what users and reviewers would reasonably expect, increasing the chance of covert data exfiltration or unauthorized functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code sends user-supplied place names to Open-Meteo and Nominatim over the network, despite the skill being described as a destriping utility. Unnecessary outbound requests create privacy and trust risks, and in this context they represent hidden external data flows that are unrelated to the advertised function.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The docstring explicitly describes an AOI adapter and migration to `_geoskill_core.aoi`, which contradicts the manifest's stated destriping purpose. This mismatch is a meaningful security signal because deceptive or inaccurate metadata can hide risky capabilities from users, reviewers, and policy controls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided place queries are transmitted to external geocoding services without disclosure in this file, creating a privacy issue and potential policy violation. Place names can reveal sensitive targets, travel plans, research areas, or customer locations, especially in geospatial workflows where AOIs are often sensitive.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code persistently caches resolved location data under the user's home directory without user-facing notice or retention controls. Even if the cached content seems low sensitivity, it can reveal historic places of interest and operational context to other local users, backup systems, or forensic collection.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The code forces a Chinese Accept-Language header for Nominatim requests without user choice, which unnecessarily transmits locale preference and may influence returned data in ways users did not request. In security/privacy terms, hard-coded locale signaling is an avoidable metadata leak and can create unexpected jurisdictional or content-handling behavior.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded fallback credentials allow the code to silently authenticate with an embedded account whenever the environment is unset. That creates unauthorized access risk, accidental use of a shared account, and secret leakage to any reader of the source or downstream package.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The requests to external geocoding services transmit raw user-provided place queries without any visible disclosure, consent, or just-in-time notice in this code path. That can expose sensitive geographic intent or operational context to third parties, especially when the skill's public description gives no reason to expect such sharing.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15