geoskill-vector-simplification

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:22 PM UTC
• Version: 1.0.0

Overview

The advertised vector simplifier is mostly local, but the package also ships unrelated credential, network lookup, download, and cache code that is not disclosed in the skill instructions.

Review before installing. Use only in an isolated environment without real ~/.netrc or ~/.geoskill/secrets.json files, or remove the unrelated _geoskill_core credential, AOI, and downloader modules. The main vector simplification script appears local, but the package contains broader capabilities and a hardcoded credential that should be remediated before routine use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions, yet the associated capabilities indicate access to environment variables, local file I/O, shell execution, network, and file writes. This creates an unsafe trust boundary because users may invoke what appears to be a simple offline geometry tool while granting far broader access than documented, enabling unintended data access or exfiltration if the implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is limited to local vector simplification, but the implementation reportedly includes online geocoding, arbitrary HTTP download logic, broad scientific/raster processing, and credential handling for multiple third-party services, including reading secrets from environment files and bundled fallback credentials. This is a serious scope mismatch that can expose secrets, enable covert network activity, and mislead users into executing a tool with far more powerful and risky behavior than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The vendored metadata claims the embedded core belongs to a different skill ('landsat-download') than the current geometry-simplification skill, which is a supply-chain integrity problem. This can cause reviewers, build tooling, or packaging checks to validate the wrong component provenance, making it easier for mismatched or unintended code to be shipped without detection.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file adds AOI/place-resolution and external geocoding behavior to a skill whose stated purpose is vector geometry simplification, creating materially broader capability than users would expect. That capability can transmit user-supplied place names to third-party services and pull network data, increasing privacy and supply-scope risk in a context where such behavior is not necessary for the advertised function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code performs HTTP requests to Open-Meteo and Nominatim even though external geocoding is unrelated to the declared vector simplification purpose. Unnecessary network capability expands attack surface, can leak sensitive location queries to third parties, and violates least-privilege expectations for a geometry-processing skill.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The module persists query results under the user's home directory, storing location-related inputs and outputs outside the immediate task of vector simplification. Even if intended as performance optimization, this creates unnecessary local data retention and potential privacy exposure on shared systems or multi-tenant environments.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file implements raster/CRS validation logic even though the skill is described as vector simplification. This kind of capability mismatch is dangerous because it expands the effective attack surface, can mislead reviewers and users about what the skill actually does, and may enable unintended processing paths or policy bypass in systems that trust the manifest for sandboxing, routing, or approval.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This module introduces broad credential-management capabilities for NASA Earthdata, FIRMS, OpenAI, CMA, and EOG in a skill whose stated purpose is vector geometry simplification. That mismatch materially increases risk because the skill gains the ability to discover and use unrelated secrets from the host environment, user secrets files, and netrc without a clear functional need.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads secrets from ~/.geoskill/secrets.json, environment variables, and ~/.netrc/_netrc for multiple services, giving the skill broad access to host-stored credentials. In the context of a geometry simplification skill, this is unnecessary secret harvesting capability and expands the blast radius if the skill or dependent code is abused.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The documentation says passwords are not hardcoded in skill source, yet _DEFAULTS contains a literal Earthdata username and password. Hardcoded credentials are highly dangerous because they can be extracted from source control, redistributed widely, and abused indefinitely until rotated.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a general-purpose network downloader with arbitrary URL fetching, resume support, retries, and local file writes, which is materially outside the stated scope of a vector-geometry simplification skill. In a skill context, this expands the attack surface to SSRF, untrusted content retrieval, and unexpected filesystem modification if an attacker can influence URLs, filenames, or output locations.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: A generic download primitive is unjustified for a geometry simplification/reporting skill and can be repurposed to retrieve arbitrary remote payloads or interact with internal services. Because the module supports arbitrary HTTP requests and writes results to disk, it creates capability creep that makes the skill substantially more dangerous than its declared purpose suggests.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements place-name geocoding and external network lookups, which is materially outside the declared purpose of a vector-geometry simplification skill. That capability expands the attack surface by enabling unexpected outbound requests, data exfiltration of user-supplied locations, and behavior that operators would not reasonably expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs outbound HTTP requests to Open-Meteo and Nominatim from within a geometry-simplification skill, without clear necessity tied to the advertised functionality. In this context, hidden network capability is dangerous because it can transmit user inputs to third parties and bypass least-privilege expectations for a local geometry-processing tool.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The module docstring openly states that this file is an adapter for AOI/place delegation, which conflicts with the published vector-simplification purpose of the skill. That mismatch is a supply-chain integrity issue: users and reviewers may trust the manifest while the code delivers different functionality, increasing the chance that unexpected capabilities go unnoticed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: User place queries are sent to external geocoding services without any disclosure or consent mechanism in this file, which can expose sensitive location intent or operational context. In a skill advertised for vector simplification, users are less likely to anticipate outbound sharing of their inputs, making the privacy risk more significant.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: The Nominatim request hard-codes an Accept-Language preference for Chinese without user choice, which can reveal implementation assumptions and influence returned data in ways the user did not request. While lower severity than the broader network/privacy issues, it is still an unnecessary privacy and transparency concern.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module embeds fallback credentials directly in code without any runtime warning, user disclosure, or safety controls. Even if intended as a convenience fallback, shipping credentials in code invites unauthorized reuse and creates silent authenticated behavior users do not expect.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: These helper functions silently read sensitive credentials from environment variables and local files, which can violate user expectations and make downstream secret use non-transparent. While secret access alone is not exfiltration, hidden collection of available credentials is risky and especially unjustified for this skill's purpose.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 86% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 85% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15