Geoskill: World Boundary Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 9:11 AM UTC
• Version: 5.0.1

Overview

The main downloader is mostly coherent, but the package also includes under-disclosed credential and geocoding utilities unrelated to boundary downloads, including hardcoded Earthdata credentials.

Review this skill before installing. The visible boundary-download CLI is reasonable, but the package should remove or clearly isolate the unrelated _geoskill_core credential/geocoding modules, remove and rotate the embedded Earthdata credentials, and tighten dependency specifications. Install only if you are comfortable with the extra bundled code and can verify it will not be invoked in your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrowly scoped to downloading administrative boundary vectors, but the static finding indicates the bundled code also contains unrelated geocoding, generic download tooling, raster-processing helpers, multi-service credential management, and even hardcoded default Earthdata credentials. This kind of scope creep is dangerous because hidden capabilities expand the attack surface, can trigger unexpected outbound requests or secret handling, and embedded credentials are a direct security issue if present.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The docstring states these checks are mandatory before outputs are written, but the code only exposes helper functions and does not enforce their use. If calling code assumes enforcement exists, invalid CRS, bbox, nodata, unit, or scale metadata may be written unchecked, causing downstream consumers to trust malformed geospatial outputs and potentially make incorrect analytical or operational decisions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This boundary-download skill ships a centralized credential module that can access unrelated secrets, including OpenAI, CMA, FIRMS, and EOG credentials, far beyond what the stated functionality requires. Broad secret access increases blast radius: any other code in the skill can call these helpers and silently consume or exfiltrate credentials unrelated to downloading administrative boundaries.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The module explicitly resolves OPENAI_API_KEY and multiple remote-service credentials that are unjustified for a world-boundary download tool. In this skill context, unnecessary credential access is especially dangerous because it creates covert opportunities for lateral secret harvesting without any user expectation that such services are involved.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: User-supplied place names are sent to third-party geocoding services (Open-Meteo and optionally Nominatim), which can disclose potentially sensitive location intent to external operators without explicit notice or consent. In a download-focused skill, this expands data exposure beyond the user's reasonable expectation, especially for private sites, disputed regions, or sensitive operational locations.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code writes query-derived AOI manifests to a persistent cache in the user's home directory without clear disclosure, which can leave a local history of searched locations. On shared systems or managed environments, that may expose sensitive geographic interests or operational targets to other local users, backups, or forensic review.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module contains hardcoded fallback credentials, including a concrete Earthdata username and password in source code. Hardcoded secrets are inherently unsafe because they can be extracted from the repository, reused by unauthorized parties, and normalize credential embedding despite comments claiming secrets should not appear in source.

Credential Access

High

• Category: Privilege Escalation

Content

}

# .netrc 解析（仅在 UNIX-like / WSL 下 ~/.netrc 可用；Windows 下
# 通常用 %USERPROFILE%\_netrc，但 .netrc 本身仍是约定俗成的名称）。
_NETRC_HOSTS = {
    "urs.earthdata.nasa.gov": ("EARTHDATA_USERNAME", "EARTHDATA_PASSWORD"),
    "firms.modaps.eosdis.nasa.gov": ("FIRMS_MAP_KEY",),

• Confidence: 88% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 99% confidence
• Finding: secrets.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

core
geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5

• Confidence: 90% confidence
• Finding: core

Unpinned Dependencies

Low

• Category: Supply Chain

Content

core
geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0

• Confidence: 97% confidence
• Finding: geopandas>=0.12.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

core
geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0

• Confidence: 94% confidence
• Finding: pandas>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

core
geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0

• Confidence: 93% confidence
• Finding: pycountry>=22.3.5

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0
topojson>=1.0

• Confidence: 94% confidence
• Finding: pyogrio>=0.5.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0
topojson>=1.0

• Confidence: 97% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0
topojson>=1.0

• Confidence: 93% confidence
• Finding: shapely>=1.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0
topojson>=1.0

• Confidence: 93% confidence
• Finding: topojson>=1.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.