Geoskill: Aquaculture Pond Mapping

• Outcome: Review
• Latest audit: Jul 31, 2026 · 11:24 AM UTC
• Version: 2.0.0

Overview

The skill is not clearly malicious, but it can download satellite data and then produce synthetic or incomplete pond-mapping outputs that users could mistake for real analysis.

Install only after reviewing the code path for your intended workflow. Require a real --input-ndwi dataset or a fixed, verified download-to-analysis flow before relying on outputs, and treat default no-input results as demo/synthetic. Pin dependencies or use a reviewed lockfile before installing in a sensitive environment.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill description focuses on pond mapping, but the documentation also states it can automatically download remote data when given a bbox and date range. Undeclared network access expands the trust boundary, can surprise users in restricted environments, and may result in unintended external requests, data egress, or operational policy violations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script silently falls back to synthetic data when no input raster is provided, yet still produces realistic-looking outputs and manifests. In an automated agent workflow, this can mislead users or downstream systems into treating fabricated analysis as real remote-sensing results, causing integrity and decision-making failures.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module description claims wetland/cropland conversion analysis, but the implementation never performs that analysis. This is a capability-integrity issue: users may rely on absent environmental impact outputs, leading to false assurance and incorrect operational or policy decisions.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The advertised skill is multi-temporal, but auto-download retrieves only one Sentinel-2 item and a narrow asset subset, which does not support the claimed temporal monitoring workflow. This mismatch can produce outputs that appear to represent temporal analysis without sufficient source data, undermining result integrity.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill can automatically download remote data and write numerous output files without an explicit upfront warning or confirmation. In agent contexts, hidden network and filesystem side effects can violate user expectations, create unwanted data persistence, and increase operational risk even if the behavior is not overtly malicious.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: The dependency on numpy is unpinned, so builds may resolve to different versions over time. This creates supply-chain and reproducibility risk, and in the worst case could allow an unsafe or incompatible release to be installed without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: The dependency on rasterio is unpinned, allowing package resolution to drift across environments and over time. That weakens reproducibility and increases exposure to accidental breakage or newly introduced supply-chain issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 92% confidence
• Finding: The dependency on scipy is unpinned, so installs may pull different versions depending on timing and resolver behavior. This is dangerous because it increases the chance of silently introducing vulnerable or incompatible releases into the skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for aquaculture-pond-mapping
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 95% confidence
• Finding: geoskill-data-fetcher is only lower-bounded (>=0.2.0), so any newer version may be installed without explicit review. Because this appears to be a shared data-download library that likely interacts with external services, unbounded upgrades carry added supply-chain and behavior-change risk compared with a purely local utility.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: A known-vulnerable dependency finding is credible because numpy is unspecified, so installation could resolve to versions affected by published advisories. The skill processes remote sensing data rather than untrusted native extensions directly, which somewhat lowers exploitability in context, but using an unbounded numpy version still creates real risk of inheriting vulnerable builds.

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: The scipy dependency may resolve to versions with published vulnerabilities, including insecure temporary directory handling in older releases. In this skill's geospatial processing context, that is most likely to matter on shared or multi-user systems, but it is still a legitimate supply-chain and local exploitation concern if old vulnerable versions are installed.

Static analysis

No suspicious patterns detected.