biodiversity corridor calculator

• Outcome: Pass
• Latest audit: May 28, 2026 at 12:44 PM UTC
• Version:
  1.0.0

Overview

This instruction-only skill appears to do its stated geospatial analysis job, with the main caution that exact location data is sent to a third-party API.

Install only if you are comfortable sending the analyzed center coordinates and H3 parcel indices to www.nikhilp.online. Use public or synthetic locations first, avoid confidential conservation/property sites unless you trust the service operator, and consider requiring the agent to ask before making API calls with exact locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs agents to send precise latitude/longitude coordinates and project parcel H3 indices to an external third-party API without any explicit disclosure, consent flow, or data-handling warning. This is dangerous because location and parcel data may be sensitive business, conservation, or property information, and an autonomous agent could transmit it off-platform without the user's informed approval.

VirusTotal

65/65 vendors flagged this skill as clean.