Security audit
Security checks across malware telemetry and agentic risk
This report-rendering skill mostly matches its purpose, but it under-discloses risky rendering and dependency behavior that users should review before installing.
Install only if you are comfortable reviewing or constraining the runtime: pin and vet dependencies, remove the data-fetcher dependency if it is not needed, use trusted local manifests only, avoid PDF generation for untrusted manifests, and run the renderer in a restricted environment without sensitive local files or internal network access.
if getattr(args, "synthetic", False):
return 0
for flag, accessor in FILE_ARGS.items():
path = eval(accessor)
if path is not None and not Path(path).exists():
print(f"ERROR: --{flag} not found: {path}", file=sys.stderr)
return 2geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill docx weasyprint
# Third-party dependencies used by this skill docx weasyprint
# Requirements for geospatial-report-generator # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill docx
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution