Back to skill

Security audit

Geoskill: Coastal Flood Risk

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coastal flood analysis skill, with some disclosure and data-quality caveats but no evidence of hidden, destructive, or credential-seeking behavior.

Install only if you are comfortable with Python geospatial dependencies and optional remote DEM downloads. Treat exposure statistics as demo or placeholder values unless the implementation is updated to use real population, building, road, and facility layers; verify results before using them for planning or safety decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

eval() call detected

High
Category
Dangerous Code Execution
Content
Returns exit code (0 = ok, 2 = arg error)."""
    # File existence
    for flag, accessor in FILE_ARGS.items():
        path = eval(accessor)  # noqa: S307 - safe: only string concat
        if path is not None and not Path(path).exists():
            print(f"ERROR: --{flag} not found: {path}", file=sys.stderr)
            return 2
Confidence
85% confidence
Finding
path = eval(accessor) # noqa: S307 - safe: only string concat

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
return 2
    # Numeric ranges
    for flag, (lo, hi) in NUMERIC_RANGES.items():
        val = getattr(args, flag, None)
        if val is None:
            continue
        if lo is not None and val < lo:
Confidence
50% confidence
Finding
val = getattr(args, flag, None)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
This is a mismatch because the declared description presents the skill as a coastal flood risk assessment tool that simulates scenarios and assesses exposure, which implies analysis based on relevant hazard and asset data. While the core flood modeling matches the description, the code includes undeclared external data access via auto-download from Planetary Computer, which is a resource/service use not mentioned in the description. It also relies heavily on synthetic/generated ancillary datasets, including exposure layers, meaning the stated exposure assessment is not actually based on real population/building/infrastructure inputs unless synthetic placeholders are acceptable. These are material behaviors beyond or inconsistent with the declared purpose, even though the main algorithm is aligned.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest and main English description frame the skill as a static bathtub inundation workflow driven by local inputs such as a DEM, defenses, and scenario parameters. The added documentation at L119-L132 claims the skill can automatically download external datasets from Microsoft Planetary Computer based only on bbox/date inputs, which is a materially broader behavior than the stated local assessment scope and introduces network-backed data acquisition not described in the manifest summary.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
Earlier documentation says the skill 'simulates flooding under sea level rise and storm surge scenarios,' which implies storm-surge scenario modeling. But the limitations section explicitly says 'Do not present results as "storm surge simulation" — it is a static inundation estimate,' creating an active contradiction about what the skill does.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The manifest describes static bathtub inundation, exposure assessment, and adaptation prioritization, which primarily suggests local geospatial analysis. Declaring a 'data-download' dependency tied to Planetary Computer, NASA POWER, and OSM introduces external data acquisition capability that is not explicitly justified by the stated purpose in the manifest.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest describes assessment of population, building, and infrastructure exposure and ocean connectivity, implying analysis against relevant real inputs. In file-based mode, the code loads only the DEM, then generates synthetic ocean masks and synthetic exposure layers so the pipeline can run, which means the reported exposure and connectivity-based results may not reflect actual assets or coastline conditions.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The inline documentation presents the synthesized ancillary layers as a convenience for pipeline compatibility, but those layers drive substantive outputs such as exposure summaries and priority zones. This understates the behavioral impact and conflicts with what the code really does in file-based analysis.

Missing User Warnings

Low
Confidence
88% confidence
Finding
This markdown file states that the skill can automatically download data from Microsoft Planetary Computer when certain arguments are provided. Because this involves network access and transmission of user-supplied AOI/date parameters, the description should explicitly warn users that remote requests will be made.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill documentation is primarily in English, but the data-download section is presented only in Chinese. This imposes a language constraint on part of the skill documentation without user opt-in or justification, which is a natural-language policy violation under the locale/language rule.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The generated report sets the document language to "zh-CN", which forces a specific locale in output regardless of user preference or input context. This is a natural-language policy concern because the file does not offer any language choice or explain why a Chinese locale is required.

Scope Creep

Low
Category
Excessive Agency
Content
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence
70% confidence
Finding
NOT LIMITED TO

Unpinned Dependencies

Low
Category
Supply Chain
Content
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
Confidence
60% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Third-party dependencies used by this skill
numpy
rasterio
Confidence
60% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Requirements for coastal-flood-risk
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
Confidence
50% confidence
Finding
geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
numpy

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/coastal_flood_risk.py:1250