Security audit
Security checks across malware telemetry and agentic risk
The downloader is mostly aligned with downloading VIIRS data, but it ships a credential helper with hardcoded Earthdata credentials and broad local credential-loading behavior that needs review before install.
Review or patch the package before installing in a sensitive environment. Remove and rotate the hardcoded Earthdata credentials, avoid relying on default credentials, prefer explicit environment variables for any account use, and be aware that --place can send location text to external geocoding services. Pin reviewed dependency versions if deploying this beyond local experimentation.
def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continuedef _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
"""从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
if not path.is_file():
continue
try:def load_user_secrets(path: Optional[Path] = None, *, force: bool = False) -> bool:
"""从 ``~/.geoskill/secrets.json`` 加载用户级凭证到 _DEFAULTS.
Phase 7 (2026-07-27): 第一次调用自动加载（lazy）。之后每个 helper
调用也会 lazy 加载，除非显式 ``force=True`` 强制重读。返回 Truerequests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution