Geoskill: OSM Data Download

• Outcome: Pass
• Latest audit: Aug 1, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed OpenStreetMap downloader that sends user-specified map queries to public OSM services and writes requested geodata outputs locally.

Install only in an environment where pip resolves current patched dependency versions, and keep OSM queries reasonably scoped because place names and bounding boxes are sent to public OSM/Nominatim/Overpass services. Review output paths before running because the tool writes files wherever the user directs it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities to access the network, write files, and potentially use environment configuration, but it does not declare permissions for those actions. This creates a transparency and governance gap: a user or platform may invoke the skill without understanding that it can make outbound requests and persist data locally, which is risky in agent environments even if the functionality is expected for an OSM downloader.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill exposes a raw `query` subcommand that accepts arbitrary Overpass QL, which is broader than the declared constrained modes of bbox/tag/place-based download. This creates a capability mismatch: downstream users or orchestrators may trust the manifest and unintentionally allow unrestricted external queries, including larger or different data access patterns than expected.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona>=1.8.0
requests>=2.28.0
shapely>=1.8.0
tqdm>=4.64.0

• Confidence: 93% confidence
• Finding: fiona>=1.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona>=1.8.0
requests>=2.28.0
shapely>=1.8.0
tqdm>=4.64.0

• Confidence: 93% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona>=1.8.0
requests>=2.28.0
shapely>=1.8.0
tqdm>=4.64.0

• Confidence: 92% confidence
• Finding: shapely>=1.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fiona>=1.8.0
requests>=2.28.0
shapely>=1.8.0
tqdm>=4.64.0

• Confidence: 92% confidence
• Finding: tqdm>=4.64.0

Known Vulnerable Dependency: fiona==1.8.0 — 2 advisory(ies): GHSA-g4m4-9q4c-mfw6 (Fiona affected by CVE-2020-14152 related to madler-zlib); GHSA-q5fm-55c2-v6j9 (Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib)

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: fiona==1.8.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: requests==2.28.0

Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: tqdm==4.64.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.