Geoskill: Landslide Susceptibility Assessment

• Outcome: Review
• Latest audit: Jul 31, 2026 · 1:25 PM UTC
• Version: 3.0.0

Overview

Review is recommended because the skill can produce landslide-analysis artifacts that are not backed by the real geospatial factors its description implies.

Use this only as a demo or prototype unless the publisher adds real factor-raster inputs, fails closed when required data is missing, clearly labels synthetic outputs, and wires downloaded DEM data into the model. Be aware that bbox/AOI runs may contact Microsoft Planetary Computer, and prefer pinned dependency versions for reproducible installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation exposes file read and file write capabilities through its CLI workflow, but no permissions are declared. This creates a trust and containment problem: a caller or hosting platform may treat the skill as low-privilege while it can still access local inputs and write outputs, increasing the risk of unintended data access or overwrite in environments that rely on declared permissions for policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior materially differs from the stated purpose: the skill can auto-download remote DEM data, operate in synthetic/demo mode, and apparently does not truly integrate the full set of claimed geospatial factors. This is dangerous because users may make planning or safety-related decisions based on fabricated or incomplete inputs while believing the analysis reflects real terrain, geology, rainfall, land cover, roads, and historical landslide evidence.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: In file-based mode the pipeline claims to assess susceptibility using terrain, geology, rainfall, land cover, roads, and historical landslide data, but it actually generates synthetic factor rasters and trains on those synthetic features. This can mislead users into treating outputs as evidence-based geospatial analysis when they are not, creating a serious integrity and decision-support risk in planning or safety contexts.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: For non-synthetic runs, the code returns zero-valued placeholder susceptibility, zone, and uncertainty maps instead of producing a real modeled surface. Because the skill still writes normal-looking output artifacts, users may incorrectly trust fabricated results for hazard zoning decisions.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script can automatically contact Microsoft Planetary Computer and download external data when bbox or AOI arguments are supplied, expanding the skill's behavior beyond local processing. This introduces unannounced network egress, dependency on remote services, and possible exposure of sensitive AOI information or execution context metadata.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The inline documentation says bbox-driven workflows attach real elevation data, but the downloaded DEM is not consumed by the modeling pipeline. This is dangerous because it creates false provenance and may cause users or downstream systems to believe outputs were informed by real terrain data when they were not.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The auto-download path performs external network fetches without a clear upfront warning or explicit consent step, which is problematic in security-sensitive or privacy-sensitive environments. Users may unknowingly disclose AOI bounds or trigger network activity in restricted runtimes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 96% confidence
• Finding: fiona

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 96% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 96% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona
numpy
rasterio
shapely

• Confidence: 95% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for landslide-susceptibility
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fiona

• Confidence: 94% confidence
• Finding: geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: fiona — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: fiona

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: numpy

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.