Geoskill: Mine Disturbance Monitor

• Outcome: Pass
• Latest audit: Jul 31, 2026 · 12:28 PM UTC
• Version: 2.0.0

Overview

This skill is a coherent geospatial analysis tool that reads mine imagery/boundaries, optionally downloads public satellite data when requested, and writes analysis outputs locally.

Install only in an environment where outbound access to Microsoft Planetary Computer and local storage of satellite imagery are acceptable. For production or regulated use, pin and scan the resolved Python dependencies, and prefer explicit output/cache directories so downloaded imagery and generated compliance files are easy to audit and remove.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill performs network-based STAC search and remote asset download even though its primary function is framed as monitoring/analysis. This expands the trust boundary by introducing external data retrieval, network egress, and disk writes, which can surprise operators and violate least-privilege or offline-execution expectations in restricted environments.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill auto-downloads remote imagery and persists it to disk without an explicit warning or confirmation to the user. While the fetched source appears intended, silent network transfer and storage can create privacy, compliance, and operational risk in environments where outbound access or unexpected local data retention is sensitive.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 95% confidence
• Finding: fiona

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 95% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fiona
numpy
rasterio
shapely

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona
numpy
rasterio
shapely

• Confidence: 95% confidence
• Finding: shapely

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for mine-disturbance-monitor
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fiona

• Confidence: 93% confidence
• Finding: geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: fiona — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: fiona

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: numpy

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.