Security audit
Security checks across malware telemetry and agentic risk
The main map generator is mostly local and coherent, but the package includes under-disclosed network, caching, and credential-handling helpers that do not fit the advertised offline map-export purpose.
Review this package before installing in an environment with real credentials or sensitive project locations. The main CLI appears intended for local map generation, but the bundled helper modules should be removed, narrowed, or clearly documented before use, especially the hardcoded Earthdata credentials, netrc/secrets access, external geocoding, home-directory cache, and unpinned dependencies.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio scipy matplotlib
numpy rasterio scipy matplotlib geopandas
numpy rasterio scipy matplotlib geopandas shapely
numpy rasterio scipy matplotlib geopandas shapely
rasterio scipy matplotlib geopandas shapely
scipy matplotlib geopandas shapely
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution