Geoskill: Forest Health Monitor

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:09 PM UTC
• Version: 2.0.0

Overview

This skill is presented as real forest-health monitoring, but its main workflow generates simulated results while documenting unsupported real-data download options.

Review before installing. Do not rely on this skill for operational, scientific, or regulatory forest-health decisions until it requires real input data, labels synthetic output clearly, implements or removes unsupported download/place options, and honors overwrite protection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The core workflow simulates baseline spectral indices, monitoring observations, and climate variables rather than ingesting and analyzing real user-supplied data. In a forest health monitoring skill, this is dangerous because it can produce authoritative-looking outputs, maps, and sampling plans that are fabricated, potentially driving incorrect operational or scientific decisions without obvious indication that the results are synthetic.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: When --place is provided, the script does not geocode the named location and instead silently substitutes a hard-coded AOI near Beijing. This can cause analysis to run on the wrong geography while appearing successful, leading to materially incorrect environmental assessments and misleading downstream artifacts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script creates the output directory and overwrites output files unconditionally, while exposing an --overwrite flag that is never enforced. This can destroy prior analysis artifacts or clobber files in user-specified locations, undermining data integrity and making accidental loss easier in automated workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
pyarrow
rasterio
shapely

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
pyarrow
rasterio
shapely

• Confidence: 95% confidence
• Finding: pyarrow

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
pyarrow
rasterio
shapely

• Confidence: 93% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
pyarrow
rasterio
shapely

• Confidence: 93% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for forest-health-monitor
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 97% confidence
• Finding: geoskill-data-fetcher>=0.2.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.