geoskill-temperature-anomaly-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:13 PM UTC
• Version: 1.0.0

Overview

The main mapper is mostly local, but the package also ships under-disclosed geocoding, download, and credential helpers including hardcoded Earthdata credentials.

Review before installing. The advertised anomaly-mapping command appears local, but the package contains extra helper code that can use network services, read local credential stores, write a home-directory cache, and includes hardcoded Earthdata credentials. Install only in an isolated environment after removing or auditing those bundled helpers and pinning dependencies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill declares itself as fully offline and permissionless, yet the detected capabilities include file read/write, shell, environment access, and network. Even if some of these capabilities are only implied by examples or companion code, the lack of explicit permission disclosure is a security problem because users cannot accurately assess data exposure or execution risk before running it.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a major description-behavior mismatch: a temperature-anomaly mapping skill should not also geocode via external services, download remote data, manage third-party credentials, read secrets files, or contain fallback credentials. Those hidden behaviors materially expand the attack surface and can lead to credential leakage, unintended outbound requests, secret harvesting, and execution of actions far outside the user's expected trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The vendored core metadata names a different skill ('landsat-download') than the package being analyzed, which indicates a supply-chain integrity or packaging mismatch. Such mismatches can cause reviewers and automated tooling to validate the wrong artifact, obscuring what code was actually imported or shipped and increasing the chance of unintended or malicious dependency substitution going unnoticed.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation claims credentials are not hardcoded, yet `_DEFAULTS` embeds a live-looking Earthdata username and password. Hardcoded secrets in source control are immediately recoverable by anyone with code access and can lead to unauthorized access, credential reuse compromise, and downstream account abuse.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code sends raw user-provided place queries to external geocoding services without any disclosure or consent mechanism in this module. Place names can reveal sensitive operational interest, home/work locations, or project targets, so undisclosed transmission to third parties creates a privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: Resolved place queries and AOI manifests are persisted under the user's home directory by default without clear notice in this code path. Persistent local storage can leak sensitive location intent to other local users, backup systems, support tooling, or later processes that inspect the cache directory.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This block contains hardcoded fallback credentials that will be used silently when no environment variable is set. That creates hidden authentication behavior, makes accidental unauthorized use more likely, and exposes secrets to anyone who can read the repository or package contents.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User-supplied place names are sent to third-party geocoding services without any explicit notice or consent mechanism in this file. That can leak sensitive locations or project context to external providers, especially in enterprise or regulated workflows where AOI names may reveal confidential operations.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for zh-CN without user choice. This can unnecessarily disclose language/region assumptions, affect returned results, and create privacy or compliance issues when the operator did not intend to signal a Chinese locale.

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 97% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15