Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
pyshp>=2.3.0
- Confidence
- 91% confidence
- Finding
- pyshp>=2.3.0
Security audit
Geoskill: China Coord Transform
Security checks across malware telemetry and agentic risk
Overview
This skill is a documented coordinate-conversion helper with no executable code present, no hidden persistence, and only a low dependency-versioning concern.
Before installing, note that the artifact appears to contain documentation and requirements only, so the advertised Python modules and CLI may not actually run unless supplied elsewhere. If you use Shapefile support, consider pinning pyshp to a reviewed version. Do not use the approximate GCJ-02 conversion outputs for surveying, legal, emergency, or other high-accuracy location decisions, as the skill itself warns.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
VirusTotal
61/61 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.