Geoskill: Debris Flow Risk Screening

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:06 PM UTC
• Version: 2.0.0

Overview

This skill needs review because it can look like it is analyzing real debris-flow risk while the pipeline actually uses synthetic terrain, outlet, and infrastructure data.

Install only if you understand that outputs appear to be demo or synthetic screening results, not real site-specific hazard assessments. Do not rely on this skill for safety, planning, engineering, or emergency decisions until real DEM, outlet, and infrastructure ingestion is implemented and clearly labeled. Review the optional download/cache behavior and pin dependencies before use in a production or sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises file read/write-capable behavior through its documented CLI and outputs, but no permissions or manifest scope are declared to make those capabilities explicit. Undeclared filesystem access weakens user trust boundaries and can lead to unauthorized reading of local inputs or writing files in unexpected locations when the skill is executed by an agent framework.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially diverges from the stated purpose: it introduces remote data acquisition and appears to use synthetic/demo data instead of the user-provided datasets implied by the description. This is dangerous because users may make risk decisions based on misleading outputs, while the hidden network behavior expands the attack surface and data-handling scope beyond what was disclosed.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The later documentation introduces automatic downloading from Microsoft Planetary Computer, but this remote acquisition capability is not reflected in the earlier interface or manifest expectations. Hidden or under-declared network access can cause unanticipated data egress, licensing/compliance issues, and execution in environments that assume the skill is local-only.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill documentation broadens the skill from local debris-flow screening into satellite/data-download functionality not described in the manifest. Scope expansion without declaration is risky because it changes trust assumptions, potentially introduces network and storage side effects, and can mislead users about what the skill will do in their environment.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The pipeline advertises analysis of user-provided DEM, outlet, and infrastructure data, but the main workflow unconditionally generates and uses synthetic DEM/outlet/infrastructure arrays instead. In a hazard-screening skill, this is dangerous because users may make planning or safety decisions based on outputs that appear real but are detached from the requested area and inputs.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The auto-download path writes a fetched DEM path to args.dem even though no --dem CLI argument exists, and the pipeline later ignores that value by replacing it with synthetic DEM data. This creates a misleading data provenance chain where logs and manifests can imply real-source processing occurred when outputs actually come from fabricated terrain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for debris-flow-risk
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 97% confidence
• Finding: geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/debris_flow_risk.py:91