Geoskill: Crop Condition Monitor

• Outcome: Review
• Latest audit: Jul 31, 2026 · 11:34 AM UTC
• Version: 2.0.0

Overview

This crop-monitoring skill is not malware, but its download mode can present visual satellite previews as NDVI crop-health analysis.

Review this skill before using it for real agricultural or hazard decisions. It appears locally scoped and non-destructive, but auto-download results should be treated as preview/proxy analysis unless the workflow is changed to use true red and near-infrared bands to compute NDVI. Pin dependencies if you need reproducible installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code claims to assess crop health from NDVI time series, but the auto-download path fetches Sentinel-2 visual or thumbnail assets and treats band 1 as an NDVI proxy. This can silently produce scientifically invalid outputs while presenting them as NDVI-based crop condition assessments, creating integrity risk for downstream decisions in agriculture or monitoring workflows.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description uses broad routing language like 'analyze changes, detect hazards, or generate assessment reports' without clearly constraining the exact inputs, preconditions, or supported modes. This can cause over-broad invocation and unintended handling of user requests or datasets outside the intended NDVI-monitoring workflow, increasing the chance of misuse or unsafe tool chaining.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for crop-condition-monitor
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 98% confidence
• Finding: geoskill-data-fetcher>=0.2.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.