Geoskill: Grassland Degradation Monitor

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:13 PM UTC
• Version: 2.0.0

Overview

The skill is mostly a grassland-analysis tool, but its advertised download mode can produce results that appear based on downloaded imagery even though the analysis uses local NDVI input or synthetic data instead.

Review this skill before installing. Use it only if you are comfortable with external geospatial downloads and local caching, and do not rely on bbox/date download results for real management decisions unless the code is fixed to analyze the downloaded imagery or clearly labels synthetic/demo outputs.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities that read from and write to the local filesystem, but it does not declare those permissions explicitly. Undeclared file access weakens user consent and policy enforcement because an execution environment may permit operations the manifest does not clearly advertise, increasing the risk of unintended data exposure or overwriting local files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose and the described behavior diverge in several important ways, including remote data downloads, synthetic data generation, and unsupported or unused analytical claims. This mismatch is security-relevant because operators may trust the skill for bounded offline analysis while it actually performs network-dependent actions and potentially produces misleading outputs, undermining both trust and control.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The later documentation introduces automatic downloading from Microsoft Planetary Computer, which materially expands the skill's behavior from local analysis to external network interaction. Hidden or poorly disclosed network access can expose user-supplied AOIs, create compliance issues in restricted environments, and invalidate assumptions that the tool only processes local data.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file presents conflicting interfaces: the main CLI section documents one set of arguments, while the later section describes additional parameters and automatic download behavior. Inconsistent interface documentation can cause users or orchestrators to invoke unintended code paths, including network retrieval and alternate input handling that were not reviewed under the primary interface contract.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The skill advertises and performs Sentinel-2 auto-download, but the fetched image is never consumed by the analysis path, which instead uses `--input-ndvi` or synthetic data. This creates a deceptive workflow where users may trust results as being based on remotely fetched imagery when they are not, enabling silent data-integrity failures and potentially causing incorrect operational decisions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: The dependency on numpy is unpinned, so builds may resolve to different versions over time, reducing reproducibility and increasing supply-chain risk if a bad or incompatible release is pulled. In a geospatial analysis skill this is not directly exploitable by itself, but it weakens dependency integrity and makes it harder to control exposure to vulnerable versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: The rasterio requirement is unpinned, which allows environment-dependent resolution to arbitrary newer releases and can introduce unexpected vulnerable or incompatible versions. For a skill processing raster data, dependency drift can affect both security posture and operational reliability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 97% confidence
• Finding: The scipy dependency is unpinned, creating non-reproducible installations and a supply-chain exposure window where a newly published release could be pulled without prior validation. This is especially relevant because later findings indicate known advisories affecting some scipy versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for grassland-degradation-monitor
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 94% confidence
• Finding: Using geoskill-data-fetcher>=0.2.0 leaves the upper bound open, so future installations may resolve to substantially different versions than originally tested. Because this shared library performs data downloads, uncontrolled upgrades could expand supply-chain and remote-data handling risk if a compromised or buggy release is introduced.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: The requirements file does not constrain numpy to a known-safe version, and the scanner reports multiple historical advisories affecting some numpy releases. Without a version pin, an environment could install an affected version, though exploitability depends on the actual resolved version and whether vulnerable code paths are reachable in this grassland-monitoring workflow.

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: SciPy has known advisories in older releases, and because the skill leaves scipy unconstrained, deployments may pick an affected version. While this analysis skill is not inherently high-risk, scientific libraries sometimes process complex inputs and temporary files, so outdated vulnerable versions can increase attack surface on shared systems.

Static analysis

No suspicious patterns detected.