Security audit

Geoskill: Forest Fire Burn Severity

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because its automatic download mode can produce burn-severity reports from unsuitable or heuristically assigned imagery, though I found no credential theft, destructive action, or hidden persistence.

Install only with care. Prefer supplying verified local pre-fire and post-fire NIR/SWIR GeoTIFFs. Treat bbox/date auto-download outputs as demo or exploratory unless the downloaded bands, dates, alignment, and scene ordering are independently checked. Be aware that AOI/bbox and date-range queries may be sent to external imagery services and cached locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose is local burn-severity computation from specific pre/post NIR and SWIR inputs, but the skill also appears to fetch remote assets, use fallback imagery types, and infer band/time assignments heuristically. That mismatch can cause users to unknowingly permit network access and produce scientifically invalid or misleading severity outputs, which is risky in an environmental assessment context.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The requirements include a shared data-download library even though the skill is described as performing local burn-severity computation from provided imagery. This expands the attack surface by introducing code capable of network/data-access behavior not clearly required by the stated purpose, which could enable unnecessary external access or supply-chain risk if the dependency is compromised.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The comments indicate external data-download behavior that is not reflected in the manifest description, creating a transparency gap about what the skill may do. Hidden or undocumented network-related capability is a security concern because reviewers and operators may permit the skill under incorrect assumptions about its behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The auto-download workflow fetches generic visual/RGB or unrelated band assets and then assigns them to the pre/post NIR and SWIR inputs used for dNBR. That produces scientifically invalid burn-severity outputs while the report and manifest still present the result as if it came from proper pre/post-fire NIR/SWIR analysis, which is an integrity issue that can mislead downstream decisions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This code assigns a single downloaded file to all four inputs, making pre-fire and post-fire imagery identical and collapsing the dNBR calculation into meaningless output. Because the skill still emits a formal burn-severity report and manifest, users may trust incorrect results for situational awareness or resource allocation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation states that the skill may automatically download data from an external service without clearly warning the user about network access, external requests, caching, or possible transmission of AOI/bounding-box information. Undisclosed network behavior is a real security and privacy concern because users may run the skill assuming it only processes local files.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy rasterio
Confidence: 95% confidence
Finding: The numpy dependency is unpinned, so installs may resolve to different versions over time, including newly introduced breaking or vulnerable releases. This weakens reproducibility and increases supply-chain risk because security posture can change without any code change in the skill itself.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio
Confidence: 95% confidence
Finding: The rasterio dependency is unpinned, allowing environment-dependent resolution to arbitrary future versions. This can introduce vulnerable or incompatible builds and makes it harder to audit and reproduce secure deployments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for forest-fire-burn-severity # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 90% confidence
Finding: Using geoskill-data-fetcher>=0.2.0 permits any later major/minor release, including versions with changed behavior or new vulnerabilities. Because this package appears to provide external data-download functionality, loose versioning increases both supply-chain and unexpected network-capability risk in a skill whose description does not clearly require it.

Static analysis

No suspicious patterns detected.