geoskill-urban-canyon-analysis

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:18 PM UTC
• Version: 1.0.0

Overview

The main tool appears to do local urban-canyon analysis, but the package also ships under-disclosed network, download, caching, and credential-handling code.

Install only after reviewing or removing the unused geocoding, downloader, caching, and credential modules. The main CLI looks local, but the package includes code that can contact third-party services and read local credential stores if invoked.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation declares no permissions while the analyzed capability set indicates access to environment variables, filesystem, shell, and network. That mismatch is dangerous because users and reviewers cannot make an informed trust decision, and these capabilities materially expand the attack surface beyond an offline geospatial analysis task.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill presents itself as local urban canyon analysis, but the detected behavior includes geocoding, arbitrary downloading, credential management for multiple external services, and even hardcoded fallback credentials. In this context, hidden network and credential-handling logic is especially risky because it violates user expectations of offline/local processing and could expose secrets, enable unauthorized external access, or conceal unrelated functionality.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored metadata declares a 'landsat-download' component inside a skill whose stated purpose is DSM-based urban canyon analysis, which is a strong supply-chain scope mismatch. Even without code execution evidence in this file, the presence of an unrelated downloader package increases the attack surface and may introduce unnecessary network, data access, or hidden functionality inconsistent with user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The vendored file list includes capabilities such as 'safe_download.py' and 'credentials.py', which are not justified by a local geometric analysis task and suggest hidden data acquisition or secret-handling behavior. In this context, unnecessary download and credential code is dangerous because it can enable unauthorized outbound access, secret exposure, or expanded compromise paths through a dependency the user would not reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: This module expands the skill’s effective behavior beyond the stated DSM-only urban canyon/SVF analysis by resolving place names via online services and persisting cache data locally. That scope mismatch matters because it introduces network egress and local data retention that users may not expect, increasing privacy and trust risk even if the code is not overtly malicious.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code sends user-supplied place queries to third-party services (Open-Meteo and Nominatim), which creates undisclosed data exfiltration and dependency on external infrastructure unrelated to the advertised offline DSM analysis. Even though HTTPS is used, sensitive or proprietary location queries may be exposed to external providers and logged outside the user’s environment.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module persists cache files under the user’s home directory, storing query-derived AOI data outside the immediate analysis workflow. This can leave behind a history of searched locations and analysis context, which is a privacy and data-minimization issue when the skill’s stated role does not justify persistent storage.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: This module handles a broad set of credentials and external-service access that are not justified by the stated skill purpose of urban canyon/SVF computation. Expanding a narrowly scoped analytic skill to read and manage multiple unrelated secrets increases attack surface and creates unnecessary opportunities for secret collection or later exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code reads user-home secrets from ~/.geoskill/secrets.json and environment credentials even though the advertised skill is a narrowly analytic geospatial computation. Accessing broadly scoped local secrets in this context is dangerous because it normalizes secret harvesting behavior unrelated to the task and could expose credentials if other code paths later use or leak them.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file adds broad place-resolution and external geocoding behavior that is not necessary for a skill whose stated purpose is DSM-based urban canyon and sky-view-factor analysis. The mismatch matters because it expands the skill’s capabilities to send user-supplied place names to third-party services, increasing data egress, attack surface, and the chance of unintended network use outside the documented function of the skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The legacy fallback performs outbound HTTP requests to Open-Meteo and Nominatim using user-controlled place queries, despite the skill being described as a DSM analytics tool. Even without code execution, this creates unjustified external communication, which can leak sensitive location intent, violate least-privilege expectations, and introduce dependency on third-party services that can be abused or fail unpredictably.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The docstring presents the module as a backward-compatible adapter delegating to a unified core, but the implementation retains legacy network geocoding behavior as a fallback. That discrepancy can mislead reviewers and operators about the module’s real capabilities, causing underestimation of network egress and privacy risk during deployment or approval.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file performs external geocoding without any obvious in-file warning, consent flow, or disclosure that user-entered place names will be transmitted to third parties. In this skill context, that is more dangerous because the advertised function is local DSM analysis, so users are less likely to anticipate network disclosure of their queries.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded fallback credentials, including a real-looking Earthdata username and password, which is a direct secret-management failure. Hardcoded credentials can be extracted by anyone with code access, may grant unauthorized access to third-party services, and encourage downstream components to silently authenticate without user awareness.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Forcing the Nominatim request header to "zh-CN,zh;q=0.9" without user choice or documented need can bias results and leak assumptions about locale. In isolation this is not severe, but in a skill already making unnecessary external geocoding requests it adds avoidable privacy and correctness concerns.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 87% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 87% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 94% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 94% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 88% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15