Security audit

Geoskill: Air Quality Download

Security checks across malware telemetry and agentic risk

Overview

The skill is a user-run air-quality downloader with some inaccurate examples, but no hidden persistence, credential harvesting, destructive behavior, or automatic high-impact actions were found.

Safe to install for normal air-quality downloads, but treat the advanced examples cautiously: several commands in SKILL.md do not match the actual script, and place-name lookup sends the place query to OpenStreetMap Nominatim. Prefer explicit latitude/longitude if you do not want place names sent to a geocoding service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation presents the skill as an Open-Meteo lat/lon downloader, but later introduces CNEMC and city-based workflows that appear to be a different interface. This mismatch can cause an agent or user to invoke unsupported commands, misunderstand what external services are contacted, and make unsafe assumptions about data provenance or behavior.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill is described as a downloader, but the docs also advertise AQI calculation and local input-file processing. Expanding the apparent scope from network retrieval to file ingestion/processing without clear boundaries can mislead operators about what inputs are accepted and may cause unintended file handling in automation contexts.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The advanced examples switch from the documented Open-Meteo lat/lon interface to a city-based 'download' command and additional workflows like CI/CD and PostgreSQL import. In an agent setting, these contradictory examples materially increase risk because they may prompt execution of unintended commands, broader automation, and data movement beyond the declared skill scope.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The geocoding request hard-codes an Accept-Language preference of zh-CN,zh;q=0.9, which can disclose a language/locale preference to the third-party geocoding service without user consent. In this skill context, requests already send user-supplied place data to Nominatim, so the added privacy impact is limited, but it still unnecessarily injects potentially identifying preference metadata and may bias results unexpectedly.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 97% confidence
Finding: requests>=2.28.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.