nasa-dataset-download

• Outcome: Review
• Latest audit: Jul 26, 2026 · 7:22 PM UTC
• Version: 1.0.0

Overview

This is a real NASA data downloader, but it needs Review because it embeds live-looking Earthdata credentials and handles broader credential state than the stated purpose requires.

Review before installing. Remove and rotate the embedded Earthdata credentials, replace the documentation example with placeholders, narrow credential loading to only the Earthdata token needed for this skill, stop printing token substrings, and avoid writing credential-state metadata into QA files by default. Use an explicit output directory and small max-file limits until disk and bandwidth impact are understood.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def test_cli_login_shows_creds():
    """login 子命令: 即使 earthaccess 失败, 也应显示凭证状态."""
    proc = subprocess.run(
        [sys.executable, str(SKILL_DIR / "scripts" / "nasa_dataset_download.py"), "login"],
        capture_output=True, text=True, timeout=20,
    )

• Confidence: 86% confidence
• Finding: proc = subprocess.run( [sys.executable, str(SKILL_DIR / "scripts" / "nasa_dataset_download.py"), "login"], capture_output=True, text=True, timeout=20, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill explicitly documents capabilities to read credentials from environment variables and local files, write QA sidecars and downloaded data, invoke Python scripts, and perform authenticated network access, but it declares no permissions. This weakens user consent and review because a caller cannot tell from the manifest that the skill will access secrets and make external authenticated requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is a NASA downloader, but the analysis indicates materially broader behavior including generic credential handling for unrelated services, geocoding, generic download utilities, and hardcoded fallback credentials. That mismatch is dangerous because reviewers may approve the skill for a narrow use case while hidden or undocumented functionality accesses additional secrets or external services.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The credentials example includes what appears to be an actual username and password rather than inert placeholders. Even in documentation, embedding realistic secrets normalizes unsafe handling and may expose a real credential if it was copied from a live account.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The script prints the first 30 and last 10 characters of the Earthdata bearer token to stdout. Partial secret disclosure is still sensitive because logs are often centrally collected, shared in CI, or retained long-term, and the exposed prefix/suffix can materially aid token identification, correlation, or reconstruction attempts.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The skill tells users to store and use authentication material from default secret locations and to perform network login, but it does not present a clear warning about sensitive credential handling and external transmission. In a skill that authenticates to third-party services, missing safety guidance increases the likelihood of accidental secret exposure or misuse.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The quick start encourages bulk download to the local filesystem without clearly warning that it writes files and may transfer substantial amounts of data. That can lead to unintentional disk consumption, bandwidth costs, or downloading into sensitive locations in automated environments.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: Hardcoding a specific username and password example in documentation is an unsafe credential practice, especially for a skill centered on authentication. It can expose a real account, encourage users to imitate insecure patterns, and creates a high-risk signal when combined with secret-loading behavior.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: Place names supplied by users are sent to external geocoding providers (Open-Meteo and optionally Nominatim) without any in-code consent flow, disclosure, or privacy control, and results may also be cached locally. In a data-download skill that already handles bearer-token based workflows, undisclosed transmission of user AOIs can expose sensitive operational, research, or location intent to third parties even if no secret token is directly leaked.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module embeds a real Earthdata username and password directly in source as fallback credentials. In a credential-management component for a downloader skill, this is especially dangerous because any execution path that reaches the fallback can silently authenticate using a shared secret, exposing the account to theft, abuse, and unauthorized data access.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The token is echoed to console with substantial unmasked content, which constitutes credential disclosure. In test and CI environments, stdout is commonly captured into artifacts and monitoring systems, so this can leak reusable authentication material beyond the local machine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The QA sidecar includes the output of describe_credentials(), which can reveal whether credentials exist, their source locations, and potentially other sensitive credential-state metadata to any user or process that can read the sidecar file. While it may not dump raw secrets, exposing credential provenance and availability unnecessarily increases attack surface and can aid follow-on credential targeting or local reconnaissance.

Credential Access

High

• Category: Privilege Escalation

Content

1. `EARTHDATA_USERNAME` / `EARTHDATA_PASSWORD` / `EARTHDATA_TOKEN` env vars
2. `~/.geoskill/secrets.json` (user-level, **not** vendored)
3. `~/.netrc` entries (`machine urs.earthdata.nasa.gov`)
4. Skill defaults

**Bearer token is preferred** for CMR / LP DAAC earthdata cloud / GES DISC

• Confidence: 84% confidence
• Finding: ~/.netrc

Credential Access

High

• Category: Privilege Escalation

Content

---
name: nasa-dataset-download
description: Download any NASA Earth observation dataset (HDF / NetCDF / GeoTIFF) end-to-end. Wraps the official earthaccess library to authenticate with NASA Earthdata Login and bulk-download granules from MODIS, VIIRS, GPM, Sentinel, SMAP, ASTER, etc. Supports BBox + temporal window filtering and QA sidecars. Default credentials are loaded from ~/.geoskill/secrets.json (NASA Earthdata bearer token).
version: 0.1.0
author: ruiduobao
license: MIT

• Confidence: 88% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

AppEEARS, Worldview). Resolution order:

1. `EARTHDATA_USERNAME` / `EARTHDATA_PASSWORD` / `EARTHDATA_TOKEN` env vars
2. `~/.geoskill/secrets.json` (user-level, **not** vendored)
3. `~/.netrc` entries (`machine urs.earthdata.nasa.gov`)
4. Skill defaults

• Confidence: 88% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

- **Bulk download** any of the 52K NASA datasets in one command
- Uses the **official `earthaccess` SDK** (NSIDC's maintained library)
- Defaults to `~/.geoskill/secrets.json` for credentials (single place
  for all 40+ skills)

## Exit codes

• Confidence: 86% confidence
• Finding: secrets.json

Credential Access

High

• Category: Privilege Escalation

Content

_DEFAULTS: dict[str, str] = {
    "EARTHDATA_USERNAME": "ruiduobao",
    "EARTHDATA_PASSWORD": "Ruiduobao123",
    "EARTHDATA_TOKEN": "",  # 用户级 secrets.json 提供（不走默认值以免推到 GitHub）
    "FIRMS_MAP_KEY": "",
    "CMA_API_KEY": "",
    "OPENAI_API_KEY": "",

• Confidence: 96% confidence
• Finding: secrets.json

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.