geoskill-water-table-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:28 PM UTC
• Version: 1.0.0

Overview

The advertised tool is a local groundwater-mapping script, but the package includes unrelated credential, downloader, and online geocoding helpers that are not disclosed by the skill instructions.

Review before installing. The visible mapping workflow appears local, but the package contains extra remote-service and credential code that is not explained by the skill documentation. Install only if you are comfortable auditing or removing those bundled helpers, rotating the exposed Earthdata credentials, and pinning dependencies in a controlled environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a serious description-behavior mismatch if the underlying skill actually performs online geocoding, HTTP downloading, credential loading from environment/.netrc/secrets files, and even contains hardcoded Earthdata credentials while presenting itself as an offline groundwater interpolation tool. Such hidden behavior can mislead users into granting trust to a skill that accesses the network and local secrets, increasing the risk of credential exposure, unauthorized data access, and covert data exfiltration.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The vendored core metadata claims the packaged core belongs to a different skill ('landsat-download') than the groundwater-mapping skill being reviewed. This indicates a supply-chain integrity or packaging mismatch: consumers and tooling may validate or trust the wrong component set, causing incorrect code provenance, accidental inclusion of unrelated logic, or weakened review assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends user-supplied place queries to external geocoding services (Open-Meteo and Nominatim), which creates an undeclared outbound data flow. In a skill described as offline groundwater interpolation, this can expose sensitive project locations or user-entered geographic targets to third parties and violates least-surprise expectations.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The credential module is far broader than the stated groundwater interpolation purpose and provides access paths for multiple unrelated external services. In a skill context, unnecessary credential-handling capability increases attack surface and creates opportunities for unintended credential harvesting or later exfiltration by other code paths.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The file exposes helper functions for retrieving OpenAI and several remote-service credentials without clear relevance to groundwater mapping. Even if this file alone does not transmit secrets, centralizing broad credential retrieval makes it easier for other components to access and misuse sensitive tokens outside the user's expected workflow.

Intent-Code Divergence

Critical

• Confidence: 99% confidence
• Finding: The module claims passwords are not hardcoded, but it embeds a default Earthdata username and password in source code. Hardcoded credentials can be copied from the repository by anyone with access and may enable unauthorized use of the linked external account if still valid.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This module provides a general-purpose network download primitive that is not obviously required by a groundwater interpolation/mapping skill. In a constrained analysis skill, introducing reusable HTTP fetch capability expands the attack surface for unreviewed external data access, remote payload retrieval, and supply-chain risk, especially because SHA256 verification is optional and callers can fetch arbitrary URLs.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Embedding standalone download logic inside a geospatial interpolation skill creates hidden capability drift: the skill can obtain arbitrary remote content independent of its stated purpose. In practice, this can be abused to pull malicious datasets or unexpected binaries/configuration from attacker-controlled endpoints, making the skill more dangerous than its description suggests.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file adds broad place-name resolution and outbound geocoding logic that is not clearly required by the stated skill purpose of groundwater interpolation from well-point data. Hidden or unnecessary network-capable functionality expands the attack surface, can exfiltrate user-supplied location queries to third parties, and undermines least-privilege expectations for a geospatial analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code sends user-provided place names to external services (Open-Meteo and Nominatim), which may disclose sensitive project geography or operational context to third parties. In a groundwater-mapping skill, such outbound API use is not obviously justified by the declared purpose, so the mismatch makes the behavior riskier and more likely to violate user expectations or policy.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Geocoding queries are transmitted to third-party services without any visible user-facing warning in this file, creating a privacy vulnerability through silent data disclosure. Location queries can reveal sensitive operational, personal, or commercial interests even if no classic code-execution flaw exists.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Embedding fallback credentials in code is a direct secret-management failure, especially when there is no explicit user warning that the module may silently authenticate with bundled credentials. This can lead to unauthorized account use, accidental policy violations, and spread of leaked credentials through forks, mirrors, and logs.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 78% confidence
• Finding: .netrc

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15