Geoskill: NetCDF Toolkit

• Outcome: Review
• Latest audit: Aug 1, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a local NetCDF converter, but it includes an under-documented network geocoding/download command that contradicts its “100% local” privacy claims.

Review before installing. The local info/convert/extract/subset commands fit the stated purpose, but do not use from-place unless you are comfortable sending place names, dates, bounding boxes, and dataset requests to external geocoding/data services and running adjacent downloader tools. Prefer a locked environment with reviewed dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module-level privacy notice explicitly says all processing is local and no data is transmitted, but the file contains a from-place flow that resolves places and invokes downloader tooling to fetch remote datasets. This is dangerous because users and downstream agents may make trust decisions based on the false privacy claim and unknowingly expose place queries, time ranges, and usage patterns to external services.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The CLI is presented as a local NetCDF/HDF toolkit, but the from-place subcommand expands scope to remote place resolution and remote data acquisition. That mismatch increases the risk of unsafe automation and policy bypass because callers may treat the tool as local-only when it can actually contact outside services and fetch new data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes geocoding and subprocess-driven external data acquisition that are not aligned with the apparent purpose of a local-file conversion toolkit. In agent or sandboxed environments, hidden scope expansion like this can cause unintended egress, policy violations, and surprising access to adjacent skills/scripts.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The top-level statement that no data is uploaded or transmitted is contradicted by the network-capable from-place command. Such deceptive or inaccurate privacy messaging is dangerous because it can directly cause users, orchestrators, or policy engines to permit execution under false assumptions about data egress.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The from-place flow resolves a place and runs a downloader subprocess without an in-band warning or confirmation at execution time. In contexts where this skill is invoked by agents or users expecting local processing, the silent network behavior can lead to unintended disclosure of sensitive locations or workflow metadata.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

h5netcdf>=1.0.0
netCDF4>=1.6.0
numpy>=1.21.0
rasterio>=1.3.0

• Confidence: 92% confidence
• Finding: h5netcdf>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

h5netcdf>=1.0.0
netCDF4>=1.6.0
numpy>=1.21.0
rasterio>=1.3.0

• Confidence: 92% confidence
• Finding: netCDF4>=1.6.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

h5netcdf>=1.0.0
netCDF4>=1.6.0
numpy>=1.21.0
rasterio>=1.3.0

• Confidence: 93% confidence
• Finding: numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

h5netcdf>=1.0.0
netCDF4>=1.6.0
numpy>=1.21.0
rasterio>=1.3.0

• Confidence: 92% confidence
• Finding: rasterio>=1.3.0

Known Vulnerable Dependency: numpy==1.21.0 — 1 advisory(ies): CVE-2021-34141 (Incorrect Comparison in NumPy)

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: numpy==1.21.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/netcdf-toolkit.py:569