Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a TNFD screening tool, but it has an under-disclosed auto-download mode that can fetch remote imagery and then fall back to synthetic results instead of analyzing real asset data.
Review this before installing. Use local GeoJSON/CSV assets for meaningful screening, avoid the bbox/date auto-download mode unless you accept remote network access and local downloads, and treat any output generated without a valid asset file as demo/synthetic rather than audit evidence. Pin dependencies before production use.
"""Validate file existence and numeric ranges.
Returns exit code (0 = ok, 2 = arg error)."""
for flag, accessor in FILE_ARGS.items():
path = eval(accessor) # safe: only string concat
if path is not None and not Path(str(path)).exists():
print(f"ERROR: --{flag.replace('_', '-')} not found: {path}", file=sys.stderr)
return 2geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy shapely
# Third-party dependencies used by this skill numpy shapely
# Requirements for nature-risk-tnfd # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
VirusTotal findings are pending for this skill version.
Detected: suspicious.dynamic_code_execution