geoskill-water-purification-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:39 PM UTC
• Version: 1.0.0

Overview

The main mapping command appears local, but the package also bundles undisclosed network, credential, and hardcoded-account code that does not fit the advertised offline skill.

Install only if you are comfortable reviewing or removing the bundled geoskill_core helper modules first. The advertised command appears to do local raster processing, but the package ships unrelated code that can use network services and inspect local credential sources if imported. Avoid running it in an environment with sensitive credentials until those helpers and hardcoded defaults are removed or clearly scoped.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares itself as fully offline and only documents local raster processing, yet the detected capabilities include shell, file I/O, environment access, and network. This capability gap is dangerous because users and orchestrators may grant trust based on the manifest while the underlying implementation can access local data or external services outside the stated scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: the skill claims offline hydrological mapping, but the detected behavior includes geocoding, remote downloads, secret harvesting from environment and credential files, and even bundled fallback Earthdata credentials. That combination can expose user secrets, cause unexpected outbound data transfer, and create unauthorized access to third-party services, which is especially risky because the SKILL.md explicitly reassures users that no network requests are made.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose sensitive locations such as home addresses, facilities, or project sites. In a geospatial skill, AOI queries are often operationally sensitive, and the implementation provides no consent flow, privacy notice, or configuration that defaults to offline-only resolution before network use.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The Nominatim request hard-codes an Accept-Language header preferring Chinese, overriding user locale expectations and causing unnecessary disclosure of language/region preference to the third-party service. This is primarily a privacy and user-choice issue rather than a direct compromise, but it can bias returned data and leak contextual information about likely users.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module embeds real-looking fallback credentials directly in source code (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`). Hardcoded credentials are a direct secret exposure risk: anyone with repository access can reuse them, and downstream skills may silently authenticate with a shared account, making abuse, account compromise, and attribution problems likely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 94% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 93% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15