Security audit

GIS_SKILL_V1.0

Security checks across malware telemetry and agentic risk

Overview

This is mostly a GIS reference skill, but it also tells the agent to run persistent self-updating feedback, search, logging, and knowledge-base mutation workflows with broad triggers.

Install only if you want an active GIS knowledge-base assistant, not just passive documentation. Before using it, disable or strictly approve self-evolution, auto-search, feedback logging, and file updates; do not allow it to modify skill files, run backup/deployment commands, send data through IM/webhooks, or execute destructive database/file examples without explicit review and backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The markdown claims the script will automatically detect the source CRS, but the implementation does not reliably validate missing, empty, or incorrect spatial reference metadata before transforming data. In a GIS workflow this can silently produce misprojected outputs, causing downstream analysis, alignment, or engineering decisions to be based on corrupted geospatial positions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documented behavior and code diverge materially: `os` is not imported, command execution is unchecked, and `EPSG:auto` is not a reliable way to infer an unknown source CRS. This creates a false sense of safety around bulk reprojection, where failures or wrong assumptions may pass unnoticed and generate invalid converted datasets.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The function prints a success message without checking whether `ogr2ogr` actually succeeded. This can mislead users into trusting incomplete or failed format/projection conversions, which is especially risky in batch GIS processing where many outputs may be consumed without manual inspection.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This section goes beyond passive GIS reference material and includes actionable AddIn debugging, IPC architecture, subprocess guidance, and build/deploy steps. In a skill that should act as a knowledge base, such operational instructions can enable unintended code modification, deployment, and environment tampering, expanding the agent's capability surface beyond the declared role.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file provides specific commands to clear environment variables, invoke MSBuild, and copy ArcGIS AddIn artifacts into a live user AddIns directory. These are directly operational system-manipulation steps that could be replayed by an agent or user to alter local build state and install extensions, which exceeds the expected scope of a GIS knowledge repository.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file explicitly expands a GIS reference skill into an autonomous system that evaluates conversations, detects gaps, triggers external searches, and mutates its own knowledge base. That broader behavior increases attack surface and creates a pathway for prompt-driven scope expansion, retrieval of untrusted content, and silent state changes that are unrelated to answering a GIS question.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The document instructs the agent to write revision history and related tracking files under the local profile, meaning ordinary user interactions can cause persistent local state changes. Persistent writes create risks of data retention, tampering, unintended accumulation of sensitive content, and behavior drift over time.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: These sections define scheduled and threshold-based external searches across official sites and community platforms, then allow validated results to be added back into the knowledge base. This creates an autonomous ingestion loop from partially untrusted sources, enabling data poisoning, prompt-triggered browsing, and unreviewed expansion beyond the intended GIS reference scope.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill promises to run background actions after every conversation, including processing feedback, recording gaps, triggering searches, and updating files. This effectively turns a passive knowledge skill into a stateful autonomous workflow engine, making accidental activation, privacy issues, and persistent manipulation much more likely.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Scheduled monitoring of external sites is not necessary for normal GIS question answering and materially broadens capability. Unneeded web-monitoring features increase exposure to malicious or low-quality content, create network-side privacy leakage, and make abuse through innocuous prompts easier.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: The user scoring and categorization logic stores and interprets interaction quality in a persistent way that is unnecessary for a GIS support skill. While not directly dangerous like code execution, it introduces avoidable profiling and retention risk and can bias future behavior based on loosely defined feedback signals.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill advertises an extremely broad activation scope covering many generic GIS, mapping, ETL, database, and standards-related keywords. This can cause the skill to trigger in ordinary conversations where a narrower or more task-specific skill would be more appropriate, increasing the chance of unintended instruction injection, irrelevant takeover of the interaction, or overuse of the skill's internal behavioral rules.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger keyword lists are broad conversational phrases such as '还有呢', '还有别的吗', and correction phrases like '应该是', which can easily appear in normal user dialogue unrelated to feedback ingestion. Because this skill has self-evolution, auto-search, and feedback detection enabled, accidental matches could trigger feedback-handling or knowledge-gap workflows unexpectedly, causing unintended state changes, noisy learning signals, or untrusted content to be considered for updates.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The file defines automatic logging when broad feedback keywords are detected, including very common phrases such as “还有” and “具体怎么操作”. In an agent setting, this can cause unintended capture of ordinary user text, trigger workflow side effects without explicit consent, and pollute downstream self-evolution or correction mechanisms with ambiguous inputs.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The auto-trigger conditions include very broad, everyday phrases such as “还有呢/还有别的吗” and generic uncertainty markers like “可能/大概/建议验证”. In an agent skill with self-evolution and automatic logging/update behavior, these phrases can cause unintended activation, spurious gap creation, and unnecessary follow-on search or update workflows based on normal conversation rather than a real knowledge deficiency.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The embedded Python example calls ExportCAD with the option "Overwrite_Existing_Files" and writes to a fixed output path, which can silently replace an existing CAD file if copied and run by a user or agent. In a skill context that may be reused for automation, this increases the chance of destructive file loss because the example normalizes unsafe defaults without an explicit warning or existence check.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The AgentX examples encourage broad natural-language task execution without defining scope limits, approval gates, or prohibited actions. In an agent-enabled GIS environment, ambiguous prompts can trigger unintended data processing, access to sensitive datasets, or costly automated workflows, especially when later sections describe skill chaining and remote execution.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The IM integration section describes sending tasks and returning reports/files through enterprise messaging platforms, but it does not prominently warn about privacy, data classification, retention, or transmission to third-party services. This creates a real risk of sensitive geospatial data, file paths, screenshots, or analysis outputs being exfiltrated through chat integrations or exposed to users without appropriate authorization controls.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes a password-based token request using an admin account and labels it as 'test only', but it still normalizes sending raw credentials to the API without concrete safeguards on secret storage, least privilege, or avoiding admin credentials in examples. In a reusable skill, users often copy examples verbatim, which can lead to credential exposure in logs, notebooks, shared docs, or production scripts.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill includes production-style scripts that create derived files and may overwrite existing outputs, but it does not prominently warn users about file modification, output naming collisions, or the need to work on copies of source data. In an agent or automation context, such instructions can cause unintended bulk data changes or loss of trusted working files.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The shell conversion examples perform batch output generation and some commands can effectively replace expected deliverables or clutter working directories without any user-facing warning. In a skill intended for automation and GIS ETL, omission of modification warnings increases the chance of accidental mass file processing with irreversible workflow impact.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document includes account-creation commands with a hardcoded example password (`password123`) and admin-authenticated REST calls, but it does not clearly warn readers not to reuse example credentials or to substitute secrets from a secure source. In an ops-focused GIS deployment guide, users often copy commands directly, so this can lead to weak accounts or credential exposure in shell history, docs, or automation.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The Nginx example enables `Access-Control-Allow-Origin *` globally and allows broad methods and headers, effectively encouraging permissive cross-origin access without discussing trust boundaries or credential restrictions. In a WebGIS context exposing GeoServer/ArcGIS endpoints, this can unnecessarily widen access to administrative or sensitive geospatial services and make browser-based abuse easier from untrusted origins.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guidance explicitly recommends closing or greatly extending database transaction handling to improve FME write performance, but does not warn that doing so can reduce atomicity, increase the blast radius of failures, and leave partial writes or inconsistent data if a job aborts mid-run. In a GIS/ETL production context, this is especially risky because workflows often modify large authoritative spatial datasets in bulk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document recommends using DROP TABLE for speed without clearly stating that it is destructive and removes the table and dependent schema objects such as indexes, causing complete data loss if used on the wrong target. In automation or batch ETL, a reader may copy this optimization into production and accidentally destroy source or destination datasets rather than safely clearing load targets.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.