geoskill-super-resolution-dl

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:08 PM UTC
• Version: 1.0.0

Overview

The main tool appears to do local image super-resolution, but the package also includes undeclared credential, geocoding, downloader, and cache code that does not fit that purpose.

Review before installing. The main command looks like a local super-resolution tool, but this package carries unrelated helper code that can use credentials and network services. Install only if you trust the publisher and are comfortable with the extra bundled capabilities, or ask the publisher for a minimized package without credential, geocoding, and downloader modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises offline/local super-resolution but the detected capabilities include network, shell, environment access, and file read/write without any declared permission model. This creates a transparency and trust problem: operators may run it assuming limited local processing while it can access broader system and network resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to perform SRCNN-based local image super-resolution, but the detected behavior includes geocoding/network access, a general downloader, credential management, and even built-in NASA Earthdata fallback credentials. Hidden network and credential-handling functionality materially expands the attack surface and could enable unauthorized access, secret misuse, or unexpected data exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The vendored core manifest claims the packaged core belongs to a different skill ('landsat-download') than the declared skill being analyzed. This is a supply-chain integrity problem because it can indicate copy/paste packaging errors, mismatched vendored dependencies, or deliberate substitution of code under misleading metadata, which undermines trust in what code is actually included.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module gives the skill broad credential-access capability for multiple unrelated external services, which is inconsistent with a super-resolution skill’s stated purpose. Even without direct exfiltration in this file, expanding a skill’s ability to discover and use user secrets increases abuse potential and the blast radius if other parts of the skill are compromised.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: The module centrally exposes credentials for multiple remote sensing and weather services beyond what is needed for local image super-resolution. Over-broad secret access violates least privilege and makes the skill more dangerous because any later code path can reuse this module to harvest or misuse unrelated accounts.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module centrally exposes credentials for multiple remote sensing and weather services beyond what is needed for local image super-resolution. Over-broad secret access violates least privilege and makes the skill more dangerous because any later code path can reuse this module to harvest or misuse unrelated accounts.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The module claims it does not cache passwords, but load_user_secrets() copies secrets into the process-wide _DEFAULTS dict and suppresses reloads with a global flag. Retaining credentials in long-lived memory increases exposure to accidental disclosure through debugging, memory inspection, or reuse by unrelated code paths.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements place-name resolution and external AOI/geocoding logic, which is materially unrelated to the declared SRCNN super-resolution purpose. In a skill ecosystem, capability drift like this is dangerous because it expands the attack surface, enables undisclosed data egress to third-party services, and can conceal behavior reviewers would not expect from an image super-resolution component.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs live HTTP requests to Open-Meteo and Nominatim using user-supplied place queries, despite the skill being described as an SRCNN super-resolution tool. This creates undisclosed outbound network behavior and leaks user inputs or operational context to external services, which is especially risky because the capability is not justified by the stated purpose and may bypass user expectations or policy review.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring openly states that this module is an adapter for AOI/place resolution and legacy fallback behavior, which directly contradicts the manifest’s claimed super-resolution-only purpose. While a docstring alone is not exploit code, in context it is evidence of undeclared functionality and supports the conclusion that the skill contains hidden or mismatched capabilities that can mislead reviewers and operators.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: User-supplied place names are sent to external geocoding services (Open-Meteo and optionally Nominatim) without any disclosure or consent mechanism in this code path. In a skill whose stated purpose is image super-resolution, this creates an unexpected data egress/privacy risk because user-entered locations may be sensitive and are transmitted off-host along with a recognizable User-Agent.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Hardcoded secrets are immediately exploitable by anyone with source access, can enable unauthorized access to external services, and may also indicate credential reuse elsewhere.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes `Accept-Language: zh-CN,zh;q=0.9` without user choice, which can reveal localization assumptions, bias results, and disclose user/environment preferences unnecessarily to the third-party service. In an unrelated super-resolution skill, this unexplained locale forcing further increases suspicion because it is both unnecessary and inconsistent with the declared functionality.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 90% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15