Security audit

geoskill-tsunami-inundation-mapping

Security checks across malware telemetry and agentic risk

Overview

The main tsunami mapping tool appears local, but the package also includes undisclosed geocoding, persistent location caching, a downloader, and plaintext fallback credentials unrelated to the advertised workflow.

Review before installing. The documented tsunami CLI appears to run locally, but the package contains extra modules with network access, home-directory caching, and credential handling, including a plaintext fallback password. Install only if you trust the publisher, remove or isolate the unrelated vendored modules, rotate the exposed credential if it is real, and pin dependencies for reproducible installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill metadata declares no permissions, yet the skill documentation indicates capabilities consistent with shell execution, file read/write, environment access, and potentially network use. This creates a transparency and trust problem: users and hosting platforms may approve or run the skill under the assumption it is offline and limited, while the underlying implementation can access broader resources than disclosed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose is tsunami inundation mapping, but the static analysis indicates additional behavior including credential management with hardcoded fallback credentials, online geocoding/weather access, and a generic downloader/framework unrelated to the stated modeling task. This mismatch is dangerous because it can conceal sensitive capabilities, expand the attack surface, and enable unauthorized network activity or credential misuse under the cover of a benign geospatial skill.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the surrounding tsunami inundation skill. This supply-chain inconsistency undermines provenance and can mask unintended or unauthorized functionality, especially when operators rely on metadata to validate what code is present.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The vendored inventory includes download- and credential-related modules that do not align with a tsunami inundation mapping skill's stated purpose. Even if unused, extra capabilities enlarge the attack surface and may enable network access, secret handling, or hidden behavior inconsistent with the principle of least functionality.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The module is configured to persist cache files under the user’s home directory by default, which creates undeclared local data storage and retention of user-supplied place queries and resolved AOI metadata. While not overtly malicious, this can leak sensitive locations over time to other local users, backups, or forensic collection, especially in disaster-response or critical-infrastructure workflows.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The exported API performs place-name resolution that can trigger external network lookups, but the skill description only mentions tsunami inundation outputs and does not disclose geocoding or third-party data transfer. This creates a transparency and data-handling mismatch: user-supplied locations may be sent to outside services unexpectedly, which is especially risky for sensitive or private locations.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code sends user-provided place queries to external geocoding providers (Open-Meteo and optionally Nominatim). Even if this supports AOI selection, it broadens the skill's behavior beyond the narrowly stated purpose and can leak sensitive operational, personal, or evacuation-related locations to third parties without clear necessity or disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: User-provided place queries are sent to external geocoding providers without any consent or warning in this module, which can disclose sensitive operational locations. In a tsunami inundation and evacuation-planning context, queried places may reveal critical sites, incident locations, or planned response areas, making the privacy impact more serious than in a generic mapping tool.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Resolved AOI manifests are written persistently to the user’s home directory without user-facing notice, creating silent retention of potentially sensitive locations and bounding boxes. In this skill’s emergency-planning context, cached AOIs may expose facilities, communities, or evacuation zones long after the session ends.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The module contains hardcoded fallback credentials, including a plaintext username and password, directly in source. Embedded secrets are highly dangerous because anyone with repository or package access can recover and abuse them, and downstream deployments may silently authenticate with shared credentials if operators do not override them.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Forcing `Accept-Language: zh-CN,zh;q=0.9` without user choice can influence third-party responses and reveal assumptions about user locale or deployment context. While not severe on its own, it is an unnecessary privacy and transparency issue and may also produce biased or unexpected results for non-Chinese users.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 95% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 95% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy
Confidence: 95% confidence
Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 83% confidence
Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

Category: Supply Chain
Confidence: 82% confidence
Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:15