Security audit

Geoskill: Sentinel Downloader Skill

Security checks across malware telemetry and agentic risk

Overview

The main downloader is plausible, but the package includes under-disclosed credential-management code with hardcoded Earthdata credentials and host-level dependency installation behavior.

Review before installing. Use an isolated virtual environment, avoid running --check-deps against your system Python, remove or ignore the bundled Earthdata fallback credentials, and provide your own credentials only through trusted environment or secret-store configuration. I did not find evidence of automatic exfiltration, destructive actions, or background persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documentation advertises shell execution, dependency installation, network access, and file output, but it declares no permissions. That creates a transparency and policy-enforcement gap: a user or platform may approve the skill expecting documentation-only behavior while the skill can read/write files, access environment data, and make outbound requests. In an agent ecosystem, undeclared capabilities materially increase risk because they bypass informed consent and make abuse or accidental overreach harder to detect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a narrow Sentinel downloader, but the analyzed behavior reportedly includes geocoding, QA report generation, dependency bootstrapping, broader geospatial utilities, and especially bundled credential-management logic with hardcoded Earthdata fallback credentials. That mismatch is dangerous because users and reviewers may trust the stated purpose while hidden or underdocumented functionality expands the attack surface, and hardcoded credentials can directly enable unauthorized access or credential leakage. The skill context makes this more dangerous, not less, because a data-download tool is expected to perform network and file operations, which can help extra behavior blend in unnoticed.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The module contains hardcoded fallback credentials, including a real-looking Earthdata username and password, inside source code. Embedding secrets in a reusable skill is dangerous because anyone with code access can extract and misuse them, and the skill’s Sentinel-download context makes such credentials directly useful for authenticated remote data access.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The shell wrapper can install Python packages onto the host via pip/pip3, which changes the system state and executes code fetched from package indexes. For a downloader skill, silently expanding its scope to perform host-level package installation is risky because it can introduce supply-chain exposure and unexpected modification of the user's environment.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Hardcoded fallback credentials are present without any strong runtime warning, making accidental use likely in developer, CI, or production environments. Because these values silently activate when environment configuration is missing, they can cause unauthorized account use, credential leakage, and difficult-to-detect dependency on embedded secrets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script runs package manager commands automatically with only a generic status message, so a user invoking dependency checking may trigger network access and code installation without meaningful warning or consent. This is dangerous because pip installs execute package build/install logic and may alter the host system, making accidental or unsafe execution more likely.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 93% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 71% confidence
Finding: requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:20