Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy rasterio
- Confidence
- 93% confidence
- Finding
- numpy
Security audit
Geoskill: Forest Disturbance Alert
Security checks across malware telemetry and agentic risk
Overview
This skill is a coherent forest-disturbance analysis tool that reads user-provided or downloaded geospatial raster data and writes local reports, with only minor dependency hygiene concerns.
Before installing, consider pinning or reviewing the Python dependencies for reproducible builds. When running auto-download mode, expect it to contact Microsoft Planetary Computer and store downloaded imagery in the output/cache locations; choose those paths deliberately if working with sensitive project data.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
# Third-party dependencies used by this skill numpy rasterio
- Confidence
- 89% confidence
- Finding
- rasterio
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
# Requirements for forest-disturbance-alert # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
- Confidence
- 95% confidence
- Finding
- geoskill-data-fetcher>=0.2.0
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.