Back to skill

Security audit

Geoskill: 输电线植被风险

Security checks across malware telemetry and agentic risk

Overview

This skill mostly performs local vegetation-risk analysis, but it can automatically contact an external satellite-data service and download files in a way that is under-disclosed and not actually used by the analysis.

Review before installing in restricted or sensitive environments. Use only with data and locations you are comfortable sending as search parameters to Microsoft Planetary Computer, prefer local input files when possible, and consider requiring the publisher to add an explicit network opt-in flag, clarify data-flow documentation, remove or use the unused image download path, and pin dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

eval() call detected

High
Category
Dangerous Code Execution
Content
Returns exit code (0 = ok, 2 = arg error)."""
    # File existence
    for flag, accessor in FILE_ARGS.items():
        path = eval(accessor)
        if path is not None and not Path(path).exists():
            print(f"ERROR: --{flag} not found: {path}", file=sys.stderr)
            return 2
Confidence
98% confidence
Finding
path = eval(accessor)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation exposes file read/write capabilities through CLI usage and output generation, but no declared permissions are present to inform users or policy controls. This creates a transparency and governance gap: an orchestrator or user may treat the skill as lower-risk than it actually is, enabling unintended access to local data or filesystem locations.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented purpose is local vegetation-risk analysis, but the skill also performs automatic remote data discovery/download from Microsoft Planetary Computer and accepts image-related inputs that are not clearly tied to the core analysis. This mismatch can mislead operators about network use and data flow, causing unexpected outbound requests or processing of external content in environments that require strict offline or reviewed behavior.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation says sensitive line data is processed locally and not uploaded, yet later states the skill can automatically download data from an external service. Even if uploads are not occurring, this contradiction can cause users to make incorrect trust decisions about network isolation, compliance posture, and whether execution is safe in restricted environments.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest presents the skill as a local analysis tool, while later documentation introduces automatic remote data download capability not reflected in the manifest description. This incomplete disclosure weakens security review and permission scoping because reviewers may approve the skill under an incorrect assumption about its operational boundaries.

Context-Inappropriate Capability

Low
Confidence
79% confidence
Finding
Automatic external data downloads add a network capability beyond the clearly stated core local-analysis purpose, increasing attack surface and operational risk. In isolation this appears more like under-documented behavior than an exploit path, but it can still bypass assumptions about offline execution or approved data sources.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill can automatically reach out to Microsoft Planetary Computer, search STAC, and download remote assets to local storage based on CLI parameters. That expands the trust boundary from local geospatial processing to network-driven data ingestion, which can cause unexpected data exfiltration of AOI/date queries, unreviewed remote content intake, and side effects in environments where network access is restricted or sensitive.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The function downloads imagery and mutates args.image, but the main analysis never consumes that image, so the network and file-write side effects are disconnected from the stated analytical purpose. This makes the behavior harder to justify and audit, increasing suspicion because remote retrieval occurs without contributing to results, which is a classic indicator of unnecessary capability and hidden side effects.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
When bbox/aoi and date-range are provided, the tool may automatically perform remote downloads and create output directories/files without an explicit warning or confirmation at the point of use. In security-sensitive or sandboxed agent environments, undisclosed network access and file creation are dangerous because they can violate user expectations, policy boundaries, or operational controls even if the content is not directly malicious.

Unpinned Dependencies

Low
Category
Supply Chain
Content
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
Confidence
98% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Third-party dependencies used by this skill
numpy
rasterio
Confidence
98% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Requirements for powerline-vegetation-risk
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
Confidence
99% confidence
Finding
geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
94% confidence
Finding
numpy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/powerline_vegetation_risk.py:1039