geoskill-wetland-mapping

• Outcome: Review
• Latest audit: Aug 4, 2026 · 5:31 PM UTC
• Version: 1.0.0

Overview

The advertised wetland mapper mostly runs as an offline local tool, but the package also includes undocumented network, caching, and credential-helper code that does not fit that promise.

Install only after reviewing or removing the unused geoskill core helper modules, especially credentials.py and aoi.py. If you do use those helpers, assume place names may be sent to third-party geocoders and cached locally, and make sure no unintended credentials are exposed. Pin the dependencies before using this in a shared or production environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill metadata declares an offline/local wetland-mapping function, yet the analyzer detected capabilities for environment access, file read/write, network, and shell without corresponding permission declarations. That gap is dangerous because users and orchestrators cannot accurately assess what the skill may access or execute, increasing the risk of unintended credential exposure, local file access, or command execution if the underlying implementation uses those capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong true positive: the skill claims to perform narrow wetland classification, but the detected behavior includes generic geocoding, downloading, credential loading from environment/.netrc/secrets files, and even built-in Earthdata credential fallback. Such hidden or undocumented functionality materially expands the attack surface and can expose secrets, enable unauthorized network access, or perform actions unrelated to the stated purpose, violating user trust and least privilege.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The module sends user-supplied place names to external geocoding services and also persists query-derived results to a local cache directory under the user's home directory. In a wetland-mapping skill, this creates an unnecessary data egress and local retention path for potentially sensitive AOI queries without clear consent or configuration boundaries, which is a legitimate privacy and data-handling risk.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill description is focused on rule-based wetland mapping, but this helper embeds online geocoding capability that contacts third-party services unrelated to the core classification logic. That mismatch broadens the attack and privacy surface by introducing external dependencies, outbound requests, and service behavior that users may not expect from this skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided location queries are transmitted to external services and cached on disk without any user-facing notice in this module. Place names and AOIs can be sensitive operational or personal information, so undisclosed transmission and persistence represent a real privacy vulnerability, especially in geospatial workflows.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file hardcodes a real-looking Earthdata username and password as fallback credentials. Hardcoded secrets in source control are inherently dangerous: they can be harvested by anyone with repository access, reused in other environments, and silently cause the skill to authenticate with an embedded account without explicit user consent.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The Nominatim request unconditionally sets Accept-Language to zh-CN, which can override user expectations and leak a language/region preference the user did not choose. In a geospatial skill, this is not catastrophic, but it can affect privacy, transparency, and result integrity by biasing returned place labels toward a Chinese locale.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: scipy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/conftest.py:15