Security audit

Geoskill: Nature Risk TNFD

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a TNFD screening tool, but it has an under-disclosed auto-download mode that can fetch remote imagery and then fall back to synthetic results instead of analyzing real asset data.

Review this before installing. Use local GeoJSON/CSV assets for meaningful screening, avoid the bbox/date auto-download mode unless you accept remote network access and local downloads, and treat any output generated without a valid asset file as demo/synthetic rather than audit evidence. Pin dependencies before production use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

eval() call detected

High

Category: Dangerous Code Execution
Content: """Validate file existence and numeric ranges. Returns exit code (0 = ok, 2 = arg error).""" for flag, accessor in FILE_ARGS.items(): path = eval(accessor) # safe: only string concat if path is not None and not Path(str(path)).exists(): print(f"ERROR: --{flag.replace('_', '-')} not found: {path}", file=sys.stderr) return 2
Confidence: 95% confidence
Finding: Using eval() on even seemingly fixed strings is dangerous because it executes Python code in the current scope and normalizes an unsafe pattern into the codebase. If FILE_ARGS or related inputs are ever modified, influenced by future changes, or loaded dynamically, this becomes arbitrary code execution during argument validation.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documents file read/write behavior yet declares no permissions, creating a transparency and policy-enforcement gap. In an agent environment, undeclared filesystem access can bypass user expectations and platform controls, increasing the chance of unintended data exposure or modification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose presents a local TNFD screening tool, but the skill also appears to support remote data acquisition and a materially different workflow using bbox/date-range inputs and synthetic/demo data. This mismatch is dangerous because operators may approve or run the skill under incorrect assumptions about network access, data provenance, and evidentiary quality, leading to unauthorized external calls or misleading compliance outputs.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The Chinese-only section introduces automatic remote downloading behavior that contradicts the earlier documented CLI and output model. Hidden or inconsistently documented capabilities are risky in security review because they can conceal network activity and alternate execution paths from users and reviewers who rely on the primary documentation.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation expands the skill from local analysis into automatic remote geodata acquisition, exceeding the manifest's stated purpose. Scope expansion without corresponding permission and behavior disclosure increases the risk of unauthorized network use, unexpected data transfer, and policy noncompliance in restricted environments.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The auto-download path fetches Sentinel-2 imagery and assigns the downloaded file to args.assets, but the rest of the pipeline only knows how to parse GeoJSON or CSV asset inputs. This silent type mismatch can cause the tool to fall back to synthetic assets or produce misleading outputs, creating integrity and trust failures in an audit-oriented risk screening workflow.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The docstring and function purpose imply downloading assets for screening, but the function actually downloads Sentinel-2 scene files and mutates the asset input path. This is dangerous because operators may trust the function's name and documentation, leading to incorrect assumptions about what data was screened and what evidence the outputs represent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script can initiate network access and create local files automatically when bbox/date arguments are present, without a clear user-facing confirmation step. In an agent skill context, implicit networked behavior increases supply-chain, privacy, cost, and provenance risks because callers may not realize external data is being fetched and persisted.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy shapely
Confidence: 95% confidence
Finding: The dependency `numpy` is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk. In this file, that risk is amplified because the package also has known historical advisories and no version constraint is present to force a reviewed safe release.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy shapely
Confidence: 92% confidence
Finding: The dependency `shapely` is unpinned, allowing uncontrolled version drift across environments. This creates supply-chain and reliability risk because future releases may introduce breaking changes or vulnerabilities without any review gate in the skill's dependency specification.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for nature-risk-tnfd # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 96% confidence
Finding: `geoskill-data-fetcher>=0.2.0` uses only a lower bound, so any later version can be installed, including unreviewed releases. Because this is a shared data-download library used to access external data sources, version drift could materially change network-facing behavior and expand supply-chain risk.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 89% confidence
Finding: The requirement lists `numpy` without any version restriction, so dependency resolution may select a version affected by one or more known advisories. Even if some listed CVEs are historical or environment-dependent, leaving the package unconstrained means vulnerable versions are not excluded, which is a real security issue in the supply chain.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/nature_risk_tnfd.py:90