Geoskill: 海面油膜检测

• Outcome: Pass
• Latest audit: Jul 30, 2026 · 3:18 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed SAR oil-spill analysis tool with purpose-aligned local outputs and optional bounded satellite data download.

Before installing, confirm you are comfortable with outbound downloads from Microsoft Planetary Computer when using bbox/date-range inputs, local caching under ~/.geoskill_cache unless overridden, and unpinned scientific Python dependencies. Use a controlled environment and pin dependencies if reproducibility or compliance matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill explicitly states it can automatically download remote data from Microsoft Planetary Computer and cache it locally, but it does not present a clear warning that network access and local writes will occur. This can surprise users or agents operating in restricted, offline, privacy-sensitive, or cost-controlled environments, and may violate least-surprise and execution-safety expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script can automatically perform remote network access and download large Sentinel-1 assets when bbox/date arguments are supplied, without an explicit confirmation or prominent user-facing warning. In an agent or automated execution context, this can trigger unintended external communication, bandwidth consumption, cost, and processing of untrusted remote content, which is a meaningful security and operational risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fpdf
numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: fpdf

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fpdf
numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
fpdf
numpy
rasterio
scipy

• Confidence: 95% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fpdf
numpy
rasterio
scipy

• Confidence: 98% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for oil-spill-detection
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
fpdf

• Confidence: 93% confidence
• Finding: geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: numpy

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: scipy

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.