nasa-dataset-catalog

• Outcome: Review
• Latest audit: Jul 26, 2026 · 6:56 PM UTC
• Version: 1.0.0

Overview

The NASA catalog skill mostly matches its stated purpose, but it ships real-looking default credentials and checks unrelated credential sources, so it needs human review before installation.

Install only after replacing the plaintext credential example with placeholders, removing the embedded default Earthdata credentials, and narrowing credential handling to Earthdata-only sources. There was no evidence of exfiltration, destructive behavior, or automatic persistence, but the current credential posture is too broad for a low-friction install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises substantial capabilities—environment access, local file read/write, shell execution, and network access—but does not declare permissions or constrain them in the manifest. In an agent setting, this weakens reviewability and least-privilege controls, making it easier for the skill to access sensitive data or perform unexpected actions without explicit operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is a narrow NASA dataset catalog tool, but the observed behavior includes unrelated credential fallback logic, geocoding, raster validation, product metadata registries, and generic download helpers. This mismatch is dangerous because reviewers and users may trust the skill for one purpose while it silently has broader data access and execution pathways, increasing the chance of credential misuse or unexpected external calls.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The credential resolution order includes unrelated secrets such as OPENAI_API_KEY, CMA_API_KEY, FIRMS_MAP_KEY, and EOG credentials that are not justified by a NASA dataset catalog skill. Broad secret discovery expands the blast radius: if the skill or its dependencies log, transmit, or misuse resolved credentials, unrelated accounts and services could be exposed.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation says passwords are not hardcoded, yet `_DEFAULTS` contains a real-looking username and password fallback. Hardcoded credentials in source control are inherently sensitive because anyone with repository access can recover and reuse them, and the misleading documentation may prevent reviewers from noticing the exposure.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The documentation includes what appears to be a real username and password example in plaintext, without clearly marking them as placeholders or warning against storing actual credentials this way. This encourages insecure secret handling and could expose a real account if the sample values are valid or reused elsewhere.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The resolver transmits user-supplied place names to third-party geocoding services (Open-Meteo and optionally Nominatim), which can leak potentially sensitive location intent without clear local disclosure or consent in this component. In a dataset-search skill, AOI/place inputs may reflect private research interests, operational locations, or user whereabouts, so silent external sharing creates a meaningful privacy risk.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: Hard-coding the Accept-Language header to "zh-CN,zh;q=0.9" discloses a locale preference to Nominatim regardless of the user's actual settings or consent. This creates unnecessary metadata leakage and can misrepresent the user, which is especially problematic when combined with location lookups to external services.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The source includes hardcoded fallback credentials (`EARTHDATA_USERNAME` and `EARTHDATA_PASSWORD`). Any execution path that silently falls back to these values can authenticate with an embedded account, enabling unauthorized service access, accidental account sharing, and credential leakage through source distribution.

Credential Access

High

• Category: Privilege Escalation

Content

`EARTHDATA_TOKEN` / `FIRMS_MAP_KEY` / `OPENAI_API_KEY` / `CMA_API_KEY` /
   `EOG_USERNAME` / `EOG_PASSWORD`)
2. `~/.geoskill/secrets.json` (user-level, **not** vendored into the skill)
3. `~/.netrc` entries
4. Skill defaults (geoskill-core `_DEFAULTS`)

For a one-time setup, write to `~/.geoskill/secrets.json`:

• Confidence: 90% confidence
• Finding: ~/.netrc

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.