Security audit

Geoskill: Cadastral Change Detection

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to perform disclosed, local cadastral parcel comparison and writes expected local analysis outputs without evidence of upload, hidden execution, or destructive behavior.

Install only in an environment where you are comfortable processing cadastral and ownership data locally. Use a private --output-dir, review generated reports before sharing them, and prefer pinned or locked dependency versions for production use.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill is described as performing local cadastral parcel change detection, yet it includes a shared data-download dependency explicitly intended for external data sources. That creates unnecessary network-capable supply-chain and data-exfiltration surface for a workflow that should operate on local vector inputs, making the dependency unjustified in this context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill persistently writes multiple artifacts derived from user-supplied cadastral data, including manifests, logs, reports, and extracted field changes, without an upfront warning or opt-in control. In the context of parcel/owner datasets, these files can contain sensitive location and ownership information and may remain on disk longer than the user expects, increasing the risk of unintended disclosure through shared workstations, backups, or subsequent processing.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill fiona numpy openpyxl scipy
Confidence: 96% confidence
Finding: The fiona dependency is unpinned, so builds may silently resolve to different versions over time, including newly introduced vulnerable or incompatible releases. In geospatial processing pipelines, this weakens reproducibility and increases supply-chain risk because transitive native components can change without review.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill fiona numpy openpyxl scipy shapely
Confidence: 96% confidence
Finding: The numpy dependency is unpinned, allowing uncontrolled version drift and exposing the skill to supply-chain and reproducibility issues. Because numpy is foundational and widely depended upon, unexpected upgrades can pull in vulnerable or incompatible combinations across the environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill fiona numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: The openpyxl dependency is unpinned, which permits installation of arbitrary future or resolver-selected versions. This increases exposure to known and future parser-related issues, especially if the skill handles spreadsheet outputs or inputs during reporting workflows.

Unpinned Dependencies

Low

Category: Supply Chain
Content: fiona numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: The scipy dependency is unpinned, introducing non-deterministic installs and avoidable supply-chain risk. Since scipy may include compiled components, version drift can also alter security posture and runtime behavior in ways that are hard to audit.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy openpyxl scipy shapely
Confidence: 95% confidence
Finding: The shapely dependency is unpinned, so dependency resolution may select changing versions with different behavior or security characteristics. For geometry-processing code, this undermines reproducibility and can introduce unreviewed native-library changes indirectly.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for cadastral-change-detection # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill fiona
Confidence: 97% confidence
Finding: geoskill-data-fetcher is only lower-bounded (>=0.2.0), so any later version may be installed without review. Because it adds network/data-download capability, leaving it effectively unpinned materially increases supply-chain and remote interaction risk beyond ordinary utility libraries.

Static analysis

No suspicious patterns detected.