Geoskill: Change Detection

• Outcome: Review
• Latest audit: Aug 1, 2026 · 7:22 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches satellite change detection, but it under-discloses a networked image-fetch feature while claiming all processing is local.

Review before installing in sensitive environments. The local detect and report workflows look purpose-aligned, but avoid the fetch and place options if external disclosure of locations, dates, or project interests is not acceptable. Prefer pinned dependencies or a controlled environment for installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module docstring explicitly states that processing is local-only and that no data is sent to external servers, but the same file later implements a `fetch` command that contacts Microsoft Planetary Computer and resolves places via external services/components. This creates a misleading privacy boundary: users may invoke the skill under the assumption that no network activity or location disclosure will occur, when in fact place/date queries and remote asset requests can be transmitted externally.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The CLI help text repeats that all data is processed locally and no data is sent to external servers, yet the parser also exposes a `fetch` subcommand that performs network access. This mismatch is dangerous because operators often rely on help text and usage banners for security/privacy expectations; inaccurate claims can cause unintentional disclosure of sensitive location, time-range, and usage metadata.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The `fetch` subcommand adds remote scene discovery and download capability that expands the tool from local raster analysis into a networked data acquisition client. While the feature is plausibly useful, it materially increases the attack and privacy surface by transmitting user-supplied place and date queries to third-party infrastructure and by pulling untrusted remote content into the workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The remote fetch path sends place-derived bounding boxes, date windows, sensor preferences, and cloud-cover constraints to external services without a privacy warning that matches this behavior. Even if imagery rather than user files is fetched, those query parameters can reveal sensitive geographies, operational interests, or investigative targets.

Natural-Language Policy Violations

High

• Confidence: 99% confidence
• Finding: The natural-language privacy statement is materially false in the presence of built-in networked fetch behavior. False privacy assurances are security-relevant because they can induce users to run the tool in restricted or sensitive contexts where any external contact is prohibited or would expose protected location intent.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The CLI help reinforces an inaccurate local-only claim immediately adjacent to a parser that defines a network-enabled `fetch` command. In skill contexts, help text is often the first and only disclosure users see, so this inconsistency increases the likelihood of silent policy violations and privacy-impacting misuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
rasterio>=1.3.0
tqdm>=4.64.0

• Confidence: 95% confidence
• Finding: numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
rasterio>=1.3.0
tqdm>=4.64.0

• Confidence: 95% confidence
• Finding: rasterio>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21.0
rasterio>=1.3.0
tqdm>=4.64.0

• Confidence: 95% confidence
• Finding: tqdm>=4.64.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.