Security audit

china-admin-divisions

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent China administrative-boundary downloader, with some unused bundled utility code and unpinned dependencies that users should be aware of.

Install only if you are comfortable with a command-line tool that contacts map.ruiduobao.com and writes downloaded vector files to paths you choose. For stricter environments, pin dependencies before installation and avoid importing the bundled _geoskill_core helpers unless you also accept their geocoding/cache behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 81% confidence
Finding: A description-behavior mismatch is a real security concern because users may grant trust based on a narrowly described purpose while the packaged skill includes broader networking, geocoding, arbitrary download, and remote-sensing utility capabilities. Even if those extra functions are not malicious, undeclared general-purpose download and external lookup features materially expand the attack surface for data exfiltration, unexpected network access, and abuse beyond Chinese administrative-boundary retrieval.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The code sends user-supplied place queries to Open-Meteo and OpenStreetMap Nominatim, while the skill metadata describes only a single public API dependency. Undisclosed outbound network destinations can leak user input, violate user expectations, and bypass environment-level approval assumptions about which third parties receive data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Geocoding queries are transmitted to external providers without any disclosure visible in this file, meaning user-entered place names may be shared with third parties unexpectedly. In a skill advertised as using a different public API, this weakens informed consent and can expose potentially sensitive location interest data.

Unpinned Dependencies

Low

Category: Supply Chain
Content: Pillow>=9.0.0 admin_core
Confidence: 91% confidence
Finding: admin_core

Unpinned Dependencies

Low

Category: Supply Chain
Content: Pillow>=9.0.0 admin_core
Confidence: 95% confidence
Finding: Pillow>=9.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_china_admin_divisions.py:26