Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 xarray>=2023.1.0 zarr>=2.14.0 fsspec>=2023.1.0
- Confidence
- 97% confidence
- Finding
- requests>=2.28.0
Security audit
ERA5 Reanalysis Downloader
Security checks across malware telemetry and agentic risk
Overview
This is a coherent ERA5 weather-data downloader with expected network access and local file writes, though its dependency specifications should be tightened before sensitive use.
Install only in an environment where you are comfortable allowing public-data downloads and local output-file writes. Prefer updating or constraining the dependency versions with a lockfile before use, especially in shared or automated environments.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 xarray>=2023.1.0 zarr>=2.14.0 fsspec>=2023.1.0 aiohttp>=3.8.0
- Confidence
- 95% confidence
- Finding
- xarray>=2023.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 xarray>=2023.1.0 zarr>=2.14.0 fsspec>=2023.1.0 aiohttp>=3.8.0
- Confidence
- 95% confidence
- Finding
- zarr>=2.14.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 xarray>=2023.1.0 zarr>=2.14.0 fsspec>=2023.1.0 aiohttp>=3.8.0
- Confidence
- 95% confidence
- Finding
- fsspec>=2023.1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
xarray>=2023.1.0 zarr>=2.14.0 fsspec>=2023.1.0 aiohttp>=3.8.0
- Confidence
- 97% confidence
- Finding
- aiohttp>=3.8.0
Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
- requests==2.28.0
Known Vulnerable Dependency: aiohttp==3.8.0 — 10 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
- aiohttp==3.8.0
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/conftest.py:14