geoskill-super-resolution

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:08 PM UTC
• Version: 1.0.0

Overview

The skill presents as an offline image super-resolution tool, but the package includes undisclosed network geocoding, downloading, credential-loading code, and hardcoded Earthdata credentials.

Review this skill before installing. The main command appears to perform local super-resolution, but the package also includes unrelated network and credential-handling modules, including a hardcoded Earthdata password and code that can read local secret files. Install only if you are comfortable with that broader artifact surface, or after those modules and credentials are removed or clearly separated and disclosed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 77% confidence
• Finding: The skill declares no permissions, yet the described and detected capabilities include shell, file access, environment access, and network use. That mismatch reduces transparency and can mislead users or orchestrators about the true execution surface, increasing the chance that sensitive files, secrets, or network resources are accessed without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a local bicubic super-resolution workflow, but the detected behavior includes online geocoding, generic HTTP downloading, credential handling, caching, and even hardcoded Earthdata fallback credentials. This is a serious scope mismatch because it hides materially different behaviors from users and may enable unauthorized network access, credential misuse, or unexpected data flows far beyond the stated image-processing task.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata shows this skill bundles a `landsat-download` core with download, sensor, AOI, and credential-related modules, which is materially broader than the declared purpose of bicubic super-resolution and PSNR evaluation. This hidden capability expansion increases attack surface and can enable unexpected network access or data acquisition behavior that users would not reasonably expect from an offline image-processing skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Including download and credential-management capabilities in a skill described only as super-resolution reconstruction is a scope mismatch that can expose users to unnecessary secret handling and outbound access. Even if not overtly malicious, unjustified credential and download code creates opportunity for misuse, accidental credential exposure, or unauthorized retrieval of remote data.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module adds geocoding, outbound HTTP access, and persistent caching capabilities to a skill whose declared purpose is only bicubic super-resolution and PSNR evaluation. That mismatch materially increases attack surface and privacy risk because user-supplied place names may be transmitted to third parties and written to disk without necessity for the advertised function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs outbound requests to Open-Meteo and Nominatim using user-provided location queries, which is not justified by a super-resolution-only skill. In this context, the behavior can leak sensitive user inputs, enable unexpected data exfiltration to external services, and create dependency on remote infrastructure outside the user's expectations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module defines a persistent cache under the user's home directory and later writes AOI manifests there, introducing undisclosed local data retention unrelated to the stated super-resolution purpose. Cached place queries and derived geographic metadata can expose user interests or workflows and may persist longer than expected.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This module is materially out of scope for a skill described as bicubic super-resolution and PSNR evaluation. A super-resolution skill should not need a generic credential broker for multiple external services, because that broadens the attack surface and enables access to unrelated secrets if the skill or its dependencies are abused.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The code exposes helpers for unrelated credentials including OpenAI, CMA, FIRMS, EOG, and Earthdata, none of which are justified by the stated purpose of bicubic interpolation and PSNR scoring. Centralized access to multiple secrets creates a convenient pivot point for secret harvesting or unintended outbound use by other code in the skill.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: Despite the documentation claiming passwords must not be hardcoded, the module embeds a default Earthdata username and password in source code. Hardcoded credentials can be extracted by anyone with repository or package access, reused outside intended contexts, and may expose the associated account or downstream data services immediately.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file provides a reusable generic downloader with retry, resume, arbitrary URL support, and batch download capability, which materially exceeds the declared skill purpose of bicubic super-resolution and PSNR evaluation. In a skill whose stated function is local image enhancement, broad network retrieval increases attack surface by enabling unbounded external content acquisition, potential data ingress from untrusted sources, and capability expansion beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The exposed `safe_download`/`safe_download_many` functions accept arbitrary URLs and write downloaded content to local paths, giving the skill a general external network transfer primitive unrelated to super-resolution itself. Even though the implementation includes some safety features, the capability can still be used to fetch malicious payloads, unexpected large files, or sensitive internal resources if an attacker can influence URLs or download lists.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements place-resolution and geocoding logic, including external network lookups and AOI metadata handling, even though the skill is described as an image super-resolution tool. This capability mismatch is dangerous because it expands the skill's authority and data flows beyond its declared purpose, enabling unexpected location processing and outbound requests that users and reviewers would not anticipate.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code performs outbound requests to Open-Meteo and Nominatim, sending user-supplied place queries and headers to third-party services without any clear justification tied to super-resolution. This creates privacy, supply-chain, and policy risks because user inputs and usage patterns are disclosed externally, and the skill gains unnecessary network capability that could be abused or fail unpredictably.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Network geocoding and local cache writes occur without any user-facing disclosure, so users may not realize that their inputs are being sent to external providers and retained locally. Lack of transparency undermines informed consent and increases privacy and compliance risk, especially because these capabilities are outside the expected scope of an image super-resolution tool.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: The code hardcodes an Accept-Language preference of zh-CN for Nominatim requests, which can reveal locale assumptions and influence request handling without user choice. While lower severity than the network capability itself, it still creates unnecessary fingerprinting and behavior that may not align with user intent or regional privacy expectations.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The fallback defaults include live-looking Earthdata credentials embedded directly in code, with no user-facing disclosure that the skill may silently use them. This can lead to unauthorized account use, accidental sharing of a third party's account, and compromise if the repository or packaged artifact is accessed.

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 84% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

# 用户级 secrets 文件位置（在用户 home，**不** vendor 到 skill 内部）。
# Phase 7 (2026-07-27): 包含 NASA Earthdata bearer token 等真实凭证。
USER_SECRETS_PATH = Path.home() / ".geoskill" / "secrets.json"

# 是否已加载过用户级 secrets（避免每次调用都重读）
_user_secrets_loaded = False

• Confidence: 82% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
    """从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.

    Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
    调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 True

• Confidence: 85% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15