Security audit

Geoskill: Forest Carbon Estimate

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a forest-carbon estimator, but it contains under-disclosed network data retrieval and a random synthetic-data fallback despite claiming local-only processing.

Review this skill before installing if you need offline-only processing or handle sensitive locations. Avoid the from-canopy-height workflow unless you accept remote place/STAC lookups, and treat any synthetic placeholder output as non-production test data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is limited to local carbon estimation from GeoTIFF/CSV inputs, but the analyzed behavior reportedly includes place resolution and access to external STAC/Planetary Computer services. Undisclosed network access and remote data retrieval materially expand the trust boundary, creating risk of unintended data exfiltration, nondeterministic outputs, supply-chain exposure, and execution in environments that assume offline-only behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The header explicitly promises local-only processing and no data sent to any server, but the `from-canopy-height` path performs remote place resolution and STAC queries. This is dangerous because users may supply sensitive place names or operational locations under a false privacy assumption, causing unintended disclosure to external services.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The skill's stated purpose emphasizes estimation from supplied raster/CSV inputs, but this command adds undeclared network-enabled acquisition of remote datasets and geocoding. That broadens the trust boundary and can exfiltrate user-provided place queries or trigger unexpected internet access in restricted environments.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: When remote CHM lookup fails, the code silently falls back to synthetic random canopy-height data and continues estimation. This can produce fabricated outputs that look legitimate, undermining downstream decision-making and making failures hard to detect.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The safety disclosure says no data is sent to any server, yet the `from-canopy-height` feature performs outbound requests and writes derived outputs. In a geospatial tool, place names and AOIs may themselves be sensitive, so inaccurate safety claims materially increase privacy and compliance risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.21.0 rasterio>=1.3.0
Confidence: 90% confidence
Finding: numpy>=1.21.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.21.0 rasterio>=1.3.0
Confidence: 90% confidence
Finding: rasterio>=1.3.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/forest-carbon-estimate.py:927