Security audit

Geoskill: Cadastral Change Detection

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform disclosed, local cadastral parcel comparison and writes expected local analysis outputs without evidence of upload, hidden execution, or destructive behavior.

Install only in an environment where you are comfortable processing cadastral and ownership data locally. Use a private --output-dir, review generated reports before sharing them, and prefer pinned or locked dependency versions for production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill is described as performing local cadastral parcel change detection, yet it includes a shared data-download dependency explicitly intended for external data sources. That creates unnecessary network-capable supply-chain and data-exfiltration surface for a workflow that should operate on local vector inputs, making the dependency unjustified in this context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill persistently writes multiple artifacts derived from user-supplied cadastral data, including manifests, logs, reports, and extracted field changes, without an upfront warning or opt-in control. In the context of parcel/owner datasets, these files can contain sensitive location and ownership information and may remain on disk longer than the user expects, increasing the risk of unintended disclosure through shared workstations, backups, or subsequent processing.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill fiona numpy openpyxl scipy
Confidence: 96% confidence
Finding: fiona

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill fiona numpy openpyxl scipy shapely
Confidence: 96% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill fiona numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: openpyxl

Unpinned Dependencies

Low

Category: Supply Chain
Content: fiona numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: scipy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: shapely

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for cadastral-change-detection # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill fiona
Confidence: 97% confidence
Finding: geoskill-data-fetcher>=0.2.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.