Security audit

Geoskill: Global Surface Water

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward dataset downloader; its main risks are ordinary network downloads, disk usage, and some documentation/package-quality gaps.

Install in a virtual environment, review requirements.txt before running pip install, and prefer current patched versions of requests and tqdm. Expect the tool to download large GeoTIFF files to the output path you choose; avoid --place unless you are comfortable sending the place query to external geocoding services if that helper is later added.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The module docstring states that the tool sends only tile coordinates and layer name to the JRC service and that no other data is sent. However, when --place is used, the code calls an external place-resolution helper that resolves the raw place string via Open-Meteo and optionally Nominatim, which transmits the user's place query to third-party services before downloading data.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The file-level description presents this as a CLI to download JRC Global Surface Water layers via direct HTTP download. Adding place-name resolution through external geocoding services introduces a separate network-backed capability beyond straightforward dataset download, and no manifest is available to justify that expanded scope.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This markdown file documents direct HTTP downloads and repeated examples that save output files and directories, but it does not explicitly warn users up front that executing the skill will create local files and may consume significant disk space. Although storage estimates appear later, there is no clear user-facing caution near the primary usage flow about disk writes and space impact.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The natural-language help string states that place names should be 'Chinese or English,' which imposes a language constraint in user-facing text. There is no accompanying explanation that the tool is region-specific or that other languages may also be accepted, so this reads as an unnecessary locale restriction.

Scope Creep

Low

Category: Excessive Agency
Content: copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence: 70% confidence
Finding: NOT LIMITED TO

Unpinned Dependencies

Low

Category: Supply Chain
Content: global_surface_water requests>=2.28.0 tqdm>=4.64.0
Confidence: 60% confidence
Finding: global_surface_water

Unpinned Dependencies

Low

Category: Supply Chain
Content: global_surface_water requests>=2.28.0 tqdm>=4.64.0
Confidence: 50% confidence
Finding: requests>=2.28.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: global_surface_water requests>=2.28.0 tqdm>=4.64.0
Confidence: 50% confidence
Finding: tqdm>=4.64.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: requests==2.28.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: tqdm==4.64.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.