Geoskill: NASA Dataset Catalog

• Outcome: Review
• Latest audit: Aug 1, 2026 · 7:08 AM UTC
• Version: 3.0.0

Overview

This NASA dataset skill is mostly purpose-aligned, but its credential handling and direct download behavior need human review before installation.

Install only if you are comfortable with a CLI that reads local credential sources and performs authenticated downloads. Use a dedicated NASA Earthdata token, avoid direct --url downloads unless the URL is a trusted NASA Earthdata host, do not reuse the README's example credentials, and treat QA sidecar files as potentially sensitive because they may reveal credential source and availability metadata.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes access to environment variables, local files, persistent writes, and network services, yet no explicit permission declaration is present. This creates a transparency and governance gap: users may invoke a skill that can read secrets and make authenticated outbound requests without a clear consent boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The documented behavior exceeds the stated purpose and includes credential inspection, local catalog statistics, metadata lookup, and effectively arbitrary URL-based download behavior under the banner of NASA dataset access. Behavior/description mismatch is dangerous because it can conceal sensitive capabilities, especially downloading from authenticated endpoints or user-supplied URLs not obviously limited to NASA resources.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The credential resolution order includes unrelated secrets such as OPENAI_API_KEY, CMA_API_KEY, and EOG credentials even though the skill is presented as needing only NASA Earthdata authentication. Overbroad secret access violates least privilege and increases the blast radius if the tool leaks, logs, or misuses credentials.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The skill claims the auth command only reports source and availability, but the setup section includes realistic secret material and encourages users to place credentials in a local file. This creates a strong risk of accidental credential exposure through copy-paste, screenshots, shell history, repo commits, or shared documentation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation contains hard-coded example credentials, including a plausible username/password pair and token format, without an explicit warning that they are fake placeholders. Users may mistakenly reuse or expose real credentials in the same pattern, normalizing unsafe secret handling.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The QA sidecar persists credential-state metadata via describe_credentials() into a user-specified file without a clear warning that auth-source information will be recorded. Even if secrets are not written, the resulting artifact can disclose whether tokens or credentials exist, their source locations, and operational setup details that may aid lateral movement, social engineering, or environment fingerprinting.

Credential Access

High

• Category: Privilege Escalation

Content

`EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` / `CMA_API_KEY` /
   `EOG_USERNAME` / `EOG_PASSWORD`)
2. `~/.geoskill/secrets.json` (user-level, **not** vendored into the skill)
3. `~/.netrc` entries
4. Skill defaults (geoskill-core `_DEFAULTS`)

For a one-time setup, write to `~/.geoskill/secrets.json`:

• Confidence: 90% confidence
• Finding: Reading credentials from ~/.netrc is sensitive credential access, and in this skill it is compounded by the broader pattern of over-collecting secrets from multiple stores. If not tightly scoped, .netrc parsing can expose additional machine credentials unrelated to NASA Earthdata.

Static analysis

No suspicious patterns detected.