Back to skill

Security audit

Geoskill: Flood Extent Mapping

Security checks across malware telemetry and agentic risk

Overview

This skill performs disclosed flood-mapping work and does not show hidden data access, persistence, destructive behavior, or credential use.

Install only in an environment where geospatial Python packages can be safely resolved, prefer pinned dependency versions, and review the public-data auto-download path if network access matters for your workflow. The skill writes analysis outputs under the chosen output directory and does not appear to access credentials or run persistently.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

eval() call detected

High
Category
Dangerous Code Execution
Content
# Auto-download route: skip file check, will populate args.sar
            pass
    for flag, accessor in FILE_ARGS.items():
        path = eval(accessor)
        if path is not None and not Path(path).exists():
            print(f"ERROR: --{flag} not found: {path}", file=sys.stderr)
            return 2
Confidence
96% confidence
Finding
path = eval(accessor)

Unpinned Dependencies

Low
Category
Supply Chain
Content
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Third-party dependencies used by this skill
numpy
rasterio
Confidence
96% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Requirements for flood-extent-mapping
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
Confidence
99% confidence
Finding
geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/flood_extent_mapping.py:64