geoskill-tile-service-generator

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:15 PM UTC
• Version: 1.0.0

Overview

The tile generator itself is a local raster tiling tool, but the package includes under-disclosed credential, geocoding, download, cache, and vendored-code components that do not fit the stated offline purpose.

Review this skill before installing. The declared tile-generation workflow looks local, but the package contains extra geospatial core modules that can access local secrets, use hardcoded fallback credentials, contact external geocoding/download services, and write cache files in the home directory. Install only if you trust the publisher and are comfortable with these extra bundled capabilities, or remove/split the unused credential and network modules first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: There is a significant mismatch between the narrowly declared purpose of offline tile generation and the reported broader behaviors: online geocoding, HTTP download logic, remote service access, credential handling for multiple external services, and even embedded fallback secrets. In a skill presented as an offline/local raster tiler, hidden remote access and credential-related functionality materially increase the risk of secret exposure, unintended data exfiltration, and supply-chain style abuse because users are unlikely to expect or scrutinize those capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored metadata claims the embedded core came from a different skill ('landsat-download') than the advertised tile-service generator. This creates a supply-chain integrity problem: reviewers and tooling may trust or load code under a false provenance label, making it easier to smuggle in unrelated functionality or bypass expected review boundaries. In this context, a geospatial tiling skill should have tightly aligned provenance, so the mismatch is more suspicious than it would be in a generic shared-library manifest.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services, creating an external data exfiltration path that may disclose sensitive locations, project names, or investigation targets. In a tile-generation skill, this is more concerning because users may not expect network egress during AOI preparation.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file introduces broad credential-management capabilities, including access to multiple external services and local secret stores, which materially exceeds a raster tile generator’s stated purpose. In a skill ecosystem, unnecessary credential-handling code expands the attack surface and increases the chance that unrelated code paths can access or misuse user secrets.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Support for OpenAI, CMA, FIRMS, EOG, and Earthdata credentials is context-inappropriate for a local raster tiling skill and creates unjustified access to unrelated external services. When a low-risk utility skill can read many classes of credentials, compromise or misuse of the skill has a much larger blast radius than users would reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This file adds place-resolution and external geocoding behavior that is broader than the stated raster tile generation purpose, increasing the skill’s capability surface and causing user-supplied place names to be transmitted to third-party services. In an agent setting, this creates unnecessary data egress and hidden behavior that may surprise users, especially when place names can encode sensitive locations or internal project context.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code performs live requests to Open-Meteo and Nominatim using untrusted user input, sending place queries and metadata to external services without strong justification from the skill description. This is dangerous because it introduces undisclosed outbound network communication, privacy leakage, dependency on third-party responses, and a larger attack surface than expected for offline tile slicing.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Place queries are transmitted to external services without clear user-facing disclosure or consent, which can leak sensitive operational intent or private location data. The risk is amplified in geospatial workflows because AOIs often correspond to confidential sites, customers, or investigations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module persistently stores resolved AOI data under the user's home directory without explicit disclosure, which may leave sensitive location history on disk. On shared systems or developer workstations, this can expose past queries and inferred areas of interest to other local users or later compromise.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes a plaintext fallback username and password for Earthdata in source code. Hardcoded credentials are highly dangerous because they can be extracted from the repository, reused unintentionally in deployments, and may expose a real account or encourage insecure credential distribution patterns.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Forcing the Accept-Language header to Chinese without user opt-in can bias results, leak assumptions about the environment or operator preference, and produce incorrect or unexpected geocoding outcomes. While not severe on its own, it is a questionable hard-coded behavior in a networked resolution path and can worsen privacy and correctness issues in multi-region deployments.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 92% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 91% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 90% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15