geoskill-water-balance-calculation

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:24 PM UTC
• Version: 1.0.0

Overview

The main water-balance tool appears local, but the package also includes unrelated network, geocoding, and credential-handling code with a hardcoded password, so it needs review before use.

Review or remove the bundled _geoskill_core/credentials.py, _geoskill_core/aoi.py, _place.py, and safe_download.py before installing. Do not rely on the package's offline claim unless you restrict execution to the main water-balance script, and treat the exposed Earthdata fallback credential as compromised.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares itself as offline/local and does not document any permissions, yet the analyzed capabilities include environment access, file read/write, shell, and network. This mismatch is dangerous because it expands the attack surface beyond user expectations, enabling unreviewed access to local data, execution of external commands, and possible outbound communication if the underlying implementation is invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is a simple per-pixel water-balance computation, but the analyzed behavior includes geocoding, HTTP download tooling, broad credential management, unrelated remote-sensing registries, and even hardcoded fallback credentials. That degree of hidden functionality—especially embedded credentials and external service access unrelated to the stated task—is a severe trust-boundary violation that could enable credential abuse, covert data exfiltration, and unauthorized network activity under the guise of a benign geospatial workflow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the declared water-balance skill. This creates a supply-chain integrity problem: reviewers and automation can no longer reliably determine what code was actually vendored, increasing the risk of shipping incorrect or malicious components under misleading metadata. In this context, the mismatch is especially concerning because VENDORED.txt is meant to establish provenance and trust for bundled code.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code sends user-provided place names to third-party services (Open-Meteo and Nominatim), creating an external data disclosure channel. In a computation-focused skill, this can leak sensitive locations or project intent without explicit user awareness, and it also introduces dependency on remote services outside the local trust boundary.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This water-balance skill ships a broad credential-management module that handles multiple external services unrelated to the stated per-pixel computation task. Expanding a narrowly scoped scientific skill into a multi-service credential broker increases attack surface, raises the chance of secret misuse, and makes it easier for other code in the skill to access credentials that users would not expect this skill to touch.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The module exposes retrieval of OPENAI_API_KEY even though the declared skill purpose is raster water-balance computation and GeoTIFF/JSON output. Unnecessary access to LLM credentials is dangerous because any later-added code path, prompt-generation step, or dependency could exfiltrate data or incur unauthorized API usage using credentials the user did not expect this skill to access.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The module manages credentials for FIRMS, CMA, and EOG, none of which are justified by the advertised water-balance computation workflow. In this context, unrelated secret access is especially suspicious because it allows the skill to read and potentially use credentials from services outside user expectations, broadening both privacy and supply-chain risk.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The docstring states that passwords are not hardcoded in skill source, but the module later embeds a fallback Earthdata username and password directly in source. Hardcoded credentials are highly dangerous because anyone with source access can recover them, reuse them, or test them against other services; the misleading documentation also undermines trust and may delay detection.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file adds broad place-resolution and geocoding behavior, including external lookups and CLI handling, which is not justified by a skill whose stated purpose is per-pixel water-balance computation and closure residual output. Capability drift like this increases attack surface, enables unexpected data egress to third-party services, and may let downstream agents invoke networked functionality that operators did not intend to permit in this skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code performs outbound requests to Open-Meteo and Nominatim, creating external network and data-sharing capability unrelated to the declared water-balance calculation function. Even if the requests are only for geocoding, this can leak user-supplied place names and operational metadata to third parties and expands the skill's reachable behavior beyond its expected analytical scope.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: In normal input mode, the skill reads only precipitation and then synthesizes ET, Q, and ΔS from fixed fractions of P, while presenting outputs as water-balance components and closure residual products. This is a data-integrity vulnerability because it can mislead downstream users into treating fabricated hydrologic variables as measured or independently derived results, producing deceptively perfect closure and invalid scientific conclusions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The helper transmits geocoding queries externally without any user-facing notice in this file, which is a real privacy/security weakness when place names may encode sensitive sites or operational interests. Lack of disclosure prevents informed consent and makes the network behavior surprising in the context of a local analytical skill.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module stores fallback credentials in source code, making them accessible to anyone who can read the repository, package, logs, or artifacts derived from it. Even if intended as a convenience fallback, embedded credentials are a direct secret exposure and can enable unauthorized data access, quota exhaustion, or account compromise.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Hard-coding the Accept-Language header to Chinese forces locale preferences onto all Nominatim queries without user choice or clear necessity. This is primarily a privacy and behavior-integrity issue: it can influence returned results, reveal assumptions about the operator/environment, and produce mismatched or biased geocoding behavior for non-Chinese users.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15