geoskill-texture-feature-extraction

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:14 PM UTC
• Version: 1.0.0

Overview

The main texture extractor appears local, but the package also includes unrelated network, download, and credential-handling code that is not adequately disclosed.

Review this skill before installing. The core texture extraction script can operate locally, but the package includes extra shared code that can read credential stores, use hardcoded service credentials, cache data under the home directory, and contact external geocoding or download endpoints if invoked. Install only if you trust the publisher and are comfortable with those bundled capabilities, or ask for a version that removes the unused network and credential modules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions, yet its documented and detected capabilities include shell execution, file read/write, environment access, and network use. This creates a trust and transparency gap: users may invoke what appears to be an offline local raster-analysis skill while unintentionally granting it access to local files, secrets, or external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow GLCM texture extraction, but the analyzed behavior includes AOI geocoding, network access to external services, downloading, credential discovery from env/.netrc/secrets files, and even hardcoded default Earthdata credentials. This mismatch is dangerous because it can conceal sensitive behaviors from users, increase attack surface, and expose credentials or data through functionality unrelated to the stated task.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the declared texture-feature-extraction skill. This kind of identity mismatch breaks provenance and integrity expectations, making it easier to ship the wrong dependency set, confuse reviewers, or hide behavior copied from another skill under an unrelated name.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file vendors AOI geocoding and network-enabled location resolution into a skill whose declared purpose is GLCM texture feature extraction. That capability mismatch increases supply-chain risk because the skill contains hidden functionality unrelated to its advertised behavior, making unexpected data flows and future abuse easier to hide.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code sends user-supplied place names to external services (Open-Meteo and Nominatim), creating an outbound network channel and disclosing potentially sensitive location queries to third parties. In a texture-feature-extraction skill, this is especially risky because users would not reasonably expect external geocoding, so the capability can enable covert data exfiltration or unauthorized telemetry.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The module persists cache files under the user's home directory without explicit consent or purpose limitation. While likely intended for performance, persistent storage of place-resolution history can leak sensitive user interests or locations and creates data-retention behavior unrelated to the core texture-processing function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module is a broad credential manager for multiple external services and is materially unrelated to the stated purpose of a local GLCM texture-feature extraction skill. In this context, unnecessary credential-handling code increases attack surface and creates opportunities for secret discovery, misuse, or later exfiltration by adjacent code.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code explicitly supports OpenAI, Earthdata, FIRMS, CMA, and EOG credentials even though the skill claims only texture feature extraction. For a skill whose purpose should be local raster analysis, collecting or resolving unrelated API credentials is suspicious and dangerous because it broadens available secrets that other code paths could abuse.

Description-Behavior Mismatch

High

• Confidence: 86% confidence
• Finding: The file introduces a reusable network downloader with local file persistence even though the skill is described as local GLCM texture extraction. This functionality expands the skill's capabilities beyond its declared purpose, creating hidden supply-chain and data-ingestion risk because remote content can be fetched and written to disk without being inherent to the advertised feature set.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code adds a generic HTTP GET primitive that can fetch arbitrary URLs, which is broader than what a texture-feature-extraction skill should need. In skill ecosystems, this kind of undeclared download capability is dangerous because it enables retrieval of untrusted external artifacts, increases attack surface, and can be repurposed for unexpected network access or staging of malicious content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file adds place-resolution and geocoding behavior that is unrelated to the declared skill purpose of GLCM texture feature extraction. Hidden or unjustified capability expansion is dangerous because it can exfiltrate user-supplied location queries to third-party services and broadens the attack surface without clear need or user expectation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs outbound requests to Open-Meteo and Nominatim, which is a network capability not justified by the stated raster texture-analysis function. In a mismatched skill, such external calls can leak sensitive place names, enable covert data transmission, and make behavior harder to audit because users would not expect a texture feature extractor to contact third-party geocoding services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Place queries are transmitted to third-party geocoding providers without any user-facing disclosure in this file, which creates a privacy issue and weakens informed consent. Because location strings can be sensitive, silent transmission expands the risk of unintended data sharing and policy noncompliance.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The file contains hardcoded fallback credentials, including a plaintext Earthdata username and password. Hardcoded secrets are directly recoverable from source control, package artifacts, logs, or code review, and may enable unauthorized access wherever those credentials remain valid.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Forcing `Accept-Language: zh-CN,zh;q=0.9` without user choice or documentation creates unnecessary information disclosure about assumed locale and can bias returned results. While not severe on its own, in combination with unexpected geocoding it increases privacy risk and reinforces that the skill is performing undeclared, region-specific network behavior.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 89% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 90% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 93% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 93% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15