geoskill-urban-growth-boundary

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:19 PM UTC
• Version: 1.0.0

Overview

The main tool is an offline geospatial analysis script, but the package also contains undisclosed credential-handling and network geocoding code that does not fit the documented offline purpose.

Review this package before installing in a sensitive environment. The main advertised workflow is local UGB analysis, but the bundle includes unrelated helpers that can read local credential files, use embedded Earthdata-looking credentials, contact external geocoding services, and write a home-directory cache. Prefer installing only after those helpers are removed or clearly documented and the dependencies are pinned.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a serious description-behavior mismatch: the documented skill claims offline geospatial boundary delineation, but the reported implementation also performs network geocoding/downloads, reads local credential files such as ~/.netrc and ~/.geoskill/secrets.json, and includes hardcoded fallback credentials. In the context of a planning/geo-analysis skill, those hidden behaviors are unnecessary and dangerous because they can expose secrets, expand data access beyond user expectations, and enable unauthorized external communications.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the declared urban growth boundary skill. This kind of provenance mismatch undermines supply-chain integrity because reviewers and tooling can no longer trust that the bundled code and hashes correspond to the intended package, increasing the risk of accidental code mix-ups or hidden functionality being shipped unnoticed.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The AOI resolver sends user-supplied place names to external geocoding services (Open-Meteo and optionally Nominatim), which creates an outbound data flow not obvious from an urban-boundary delineation skill description. Even if the data is only a place string, this can leak sensitive project locations or user intent to third parties and introduces dependency on external network services.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The code persists cached AOI query results under the user's home directory, which stores potentially sensitive place queries and derived locations beyond the immediate execution. Persistent local artifacts can expose historical searches to other local users, backup systems, or later processes without the user's awareness.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring states that passwords are not cached, but `load_user_secrets()` copies secrets from `~/.geoskill/secrets.json` into the process-global `_DEFAULTS` map and retains them for the life of the process. This creates a misleading security guarantee and increases exposure in long-lived processes, debugging, memory inspection, or unintended reuse across components.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code sends user-supplied place queries to third-party geocoding services (Open-Meteo and optionally Nominatim), which can leak potentially sensitive location intent and create undeclared external data flows. In this skill context, geocoding may be functionally useful, but the manifest does not justify these outbound requests, so the main risk is privacy, policy, and unexpected network exposure rather than code execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code transmits geocoding queries to third-party services without any visible consent or disclosure mechanism in the code path. In this skill context, place names may correspond to sensitive planning, land-use, or infrastructure targets, so silent disclosure to external services is a meaningful privacy and supply-chain risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module hardcodes real-looking fallback credentials (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`) directly in source. Hardcoded credentials are a serious secret-management failure: they can be extracted from source control or artifacts, accidentally used in production, and may grant unauthorized access if valid.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: Nominatim requests unconditionally set Accept-Language to zh-CN/zh, overriding user or environment preferences without notice. This can bias results toward Chinese-localized responses, leak an inferred locale, and produce incorrect or discriminatory behavior for non-Chinese users, which is a data-handling and quality issue rather than a direct exploit primitive.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 96% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15