geoskill-virtual-globe-export

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:24 PM UTC
• Version: 1.0.0

Overview

The advertised exporter is mostly local, but the package includes unrelated credential and network helper code that is not disclosed to users.

Review this skill before installing. The exporter itself appears to operate locally, but the package carries unrelated remote-service and credential code, including hardcoded credentials and automatic reads from common secret stores. Install only if you trust the publisher and are comfortable with those bundled modules, or remove/scope them before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 72% confidence
• Finding: The skill metadata declares an offline local export tool, but the detected capabilities include network, shell, environment access, and file read/write without any explicit permission declaration or justification. This creates a trust and review gap: users may invoke a skill believing it only performs local format conversion while it may also access local files, environment secrets, execute commands, or reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as a simple offline KML/CZML exporter, yet the analyzed behavior reportedly includes credential handling, hardcoded fallback credentials, remote geocoding, downloading, and broader remote-sensing processing. Hidden network access and embedded credentials are especially dangerous because they can expose secrets, exfiltrate data, or cause users to process untrusted remote content under false assumptions of local-only behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The vendored metadata identifies the bundled core as belonging to a different skill ('landsat-download') than the declared virtual-globe export capability. This mismatch is a supply-chain integrity issue because it can conceal copied or mispackaged code, making review, provenance tracking, and security expectations unreliable; if the vendored files are not actually the intended component, unrelated functionality could be shipped unnoticed.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The code transmits user-supplied place queries to external services (Open-Meteo and optionally Nominatim) without any consent gate or clear disclosure at call sites. Even though the queries are not obviously secrets, location inputs can be sensitive and this creates an unintended data-sharing/privacy boundary, especially in a skill described primarily as an export tool.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module is a broad credential broker for multiple external services, which materially exceeds the stated purpose of a KML/CZML export skill. Expanding a skill’s trust boundary to read credentials for unrelated services increases the blast radius if the skill or a dependent component is misused, compromised, or later extended to make outbound requests.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code loads secrets from the user home directory and environment for multiple remote services, creating implicit access to sensitive credentials even though the skill description is export-only. This kind of automatic secret harvesting is dangerous because any later code path that transmits or logs resolved values could expose credentials the user did not intend this skill to access.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill’s stated purpose is exporting KML/CZML, but it also writes a full JSON dump of all features and a GeoTIFF density raster. That expands data disclosure beyond user expectations and can leak sensitive geospatial/time data into additional files that may be retained, shared, or consumed by downstream tooling unintentionally.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The privacy statement says processing is fully local and does not upload data, but the code persists operational metadata, including command-line-derived input paths, into output-manifest.json. While this is not exfiltration, it can still expose sensitive filesystem structure, filenames, or user workflow details to anyone who receives the output bundle.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The resolver performs third-party network lookups and writes a persistent cache under the user's home directory without any visible warning, consent, or retention controls. This can leak potentially sensitive location queries off-host and leave recoverable local artifacts, which is risky in privacy-sensitive environments.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The source contains hardcoded fallback credentials, including a plaintext username and password. Hardcoded secrets are highly dangerous because they can be extracted from source control, package distributions, logs, or memory, and they encourage silent authentication using shared credentials outside user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

/ `EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` /
  `CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，

• Confidence: 88% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

`CMA_API_KEY` / `EOG_USERNAME` / `EOG_PASSWORD` 任何一项显式设置
  都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

(2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。
- **不缓存密码**：每次调用读环境或 .netrc（避免长寿命进程泄露）。
- **统一接口**：`get_earthdata_creds()` / `get_earthdata_token()` /
  `get_firms_key()` / `get_cma_key()` / `get_openai_key()` /
  `get_eog_creds()` 六个 helper。

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 89% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

"EOG_PASSWORD": "",
}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),

• Confidence: 89% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue

• Confidence: 97% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _read_netrc(host: str) -> Optional[Tuple[str, ...]]:
    """从 ~/.netrc 读指定 host 的凭证（无 token 格式）。"""
    for path in (Path.home() / ".netrc", Path.home() / "_netrc"):
        if not path.is_file():
            continue
        try:

• Confidence: 97% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve(name: str) -> str:
    """env > 用户 secrets > .netrc > 默认. 空字符串视为未设."""
    env_val = os.environ.get(name, "").strip()
    if env_val:
        return env_val

• Confidence: 86% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

def _resolve_with_netrc(env_name: str, netrc_host: str, field_index: int) -> str:
    """env > 用户 secrets > .netrc > 默认."""
    env_val = os.environ.get(env_name, "").strip()
    if env_val:
        return env_val

• Confidence: 95% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_USERNAME / EARTHDATA_PASSWORD
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov
    4. _DEFAULTS 兜底
    """
    u = _resolve_with_netrc("EARTHDATA_USERNAME", "urs.earthdata.nasa.gov", 0)

• Confidence: 90% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

解析顺序：
    1. env: EARTHDATA_TOKEN
    2. ~/.geoskill/secrets.json
    3. .netrc: machine urs.earthdata.nasa.gov account <TOKEN>
    4. _DEFAULTS（通常为空）
    """
    return _resolve("EARTHDATA_TOKEN")

• Confidence: 84% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

source 字段:
    - ``"env"``         — 来自环境变量
    - ``"user_secrets"`` — 来自 ~/.geoskill/secrets.json
    - ``"netrc"``        — 来自 ~/.netrc
    - ``"default"``      — 来自 _DEFAULTS（geoskill-core 硬编码兜底）
    - ``"none"``         — 全部未配
    """

• Confidence: 80% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

都优先于默认值。
- **支持 .netrc**：若 ~/.netrc 中存在 `machine urs.earthdata.nasa.gov`
  行，优先取 .netrc 凭证。
- **支持用户级 secrets 文件** ``~/.geoskill/secrets.json``：Phase 7
  (2026-07-27) 新增。本文件在用户 home，**不** vendor 到任何 skill，
  **不** push 到 GitHub；用于把个人真实凭证（NASA Earthdata bearer
  token 等）放在 skill 之外。

• Confidence: 92% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15