Geoskill: Geospatial Report Generator

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:13 PM UTC
• Version: 2.0.0

Overview

This report-rendering skill mostly matches its purpose, but it under-discloses risky rendering and dependency behavior that users should review before installing.

Install only if you are comfortable reviewing or constraining the runtime: pin and vet dependencies, remove the data-fetcher dependency if it is not needed, use trusted local manifests only, avoid PDF generation for untrusted manifests, and run the renderer in a restricted environment without sensitive local files or internal network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

eval() call detected

High

• Category: Dangerous Code Execution

Content

if getattr(args, "synthetic", False):
        return 0
    for flag, accessor in FILE_ARGS.items():
        path = eval(accessor)
        if path is not None and not Path(path).exists():
            print(f"ERROR: --{flag} not found: {path}", file=sys.stderr)
            return 2

• Confidence: 98% confidence
• Finding: The use of eval() to resolve argument access is unnecessary and unsafe because eval executes Python expressions, not just simple lookups. Although FILE_ARGS is currently hardcoded, this pattern creates avoidable code-execution risk if the mapping is ever modified or made user-influenced, and it weakens the security posture of a tool that processes untrusted inputs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior says the tool only renders existing output-manifest.json data, but the implementation reportedly also accepts arbitrary JSON fallbacks and can generate synthetic manifests. That mismatch weakens operator trust boundaries and can cause the tool to ingest unintended local files, potentially exposing sensitive content in rendered reports or masking provenance of report data.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The requirements explicitly reference a shared data-download library even though the skill is described as render-only and non-downloading. This capability mismatch is a real security concern because it expands the skill's effective attack surface and may enable unexpected network access or data acquisition paths that users and reviewers would not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A render-only report generator should not need a data-fetching package tied to external sources such as Planetary Computer, NASA POWER, or OSM. Including such a dependency creates unjustified capability creep and raises the risk of hidden fetch behavior, transitive vulnerabilities, or abuse of the skill in ways that contradict its declared purpose.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
docx
weasyprint

• Confidence: 88% confidence
• Finding: The dependency 'docx' is unpinned, which can cause unpredictable builds and expose the skill to newly introduced malicious or vulnerable releases in the supply chain. While not an immediate exploit by itself, this weakens dependency integrity and makes reproducing secure environments harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
docx
weasyprint

• Confidence: 98% confidence
• Finding: The dependency 'weasyprint' is unpinned and also separately flagged with multiple known advisories, which significantly increases risk because installs may resolve to unsafe versions. In a renderer that processes manifests into HTML/PDF, a vulnerable rendering engine can be directly exposed to attacker-controlled content paths or URLs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for geospatial-report-generator
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
docx

• Confidence: 90% confidence
• Finding: The dependency specification 'geoskill-data-fetcher>=0.2.0' is not fully pinned, so any later version may be installed, including ones that introduce vulnerable or unsafe behavior. Because this package appears to provide data-download capabilities unnecessary for a render-only skill, the supply-chain risk is more concerning than a normal loose version range.

Known Vulnerable Dependency: weasyprint — 6 advisory(ies): CVE-2024-28184 (WeasyPrint allows the attachment of arbitrary files and URLs to a PDF); CVE-2025-68616 (WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP R); CVE-2026-49452 (WeasyPrint has CSS Injection via Presentational Hints) +3 more

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: WeasyPrint is flagged with multiple known vulnerabilities, including arbitrary file/URL attachment, SSRF-related issues, and content injection concerns. This is particularly dangerous in a report-generation skill because manifests or rendered content may contain attacker-controlled references, allowing the renderer to access internal resources, embed unintended files, or generate weaponized output documents.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/geospatial_report_generator.py:67