Security audit
Security checks across malware telemetry and agentic risk
The main tool appears to do local population-density processing, but the package also includes under-disclosed network geocoding and broad credential-handling code, including a hardcoded Earthdata password.
Review before installing. The population-estimation entrypoint itself is mostly local, but the package ships extra credential and network helpers that are not clearly disclosed. Do not install it in an environment containing real ~/.netrc, ~/.geoskill/secrets.json, or sensitive environment credentials unless those modules are removed or scoped, the hardcoded Earthdata credentials are removed and rotated, and network/cache behavior is documented or disabled.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truenumpy rasterio
numpy rasterio
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution