Back to skill

Security audit

Geoskill: 水库库容变化

Security checks across malware telemetry and agentic risk

Overview

This skill is not malware, but it needs Review because its reservoir-change claims and remote-data behavior do not line up cleanly with the implementation.

Review carefully before installing. Use this only as an exploratory reservoir curve tool unless the publisher narrows the documentation or implements true multi-temporal data use, explicit remote-download consent, and pinned dependencies. Do not rely on its current outputs for engineering, safety, regulatory, or environmental decisions without independent validation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documents CLI operations that read local inputs and write multiple output files, but it does not declare corresponding permissions or scope. Undeclared file access weakens user and platform trust boundaries because an agent may perform filesystem operations the manifest does not transparently disclose.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is presented as a local reservoir-capacity analysis tool, but later documentation introduces automatic remote downloads from Microsoft Planetary Computer. This materially changes the trust model by adding network/data-ingestion behavior that is not disclosed in the primary manifest, creating a risk of unexpected outbound access and unreviewed remote content entering the workflow.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
Automatic remote data download is introduced as an implicit behavior when certain arguments are provided, without clear scope disclosure or consent boundaries. Even if the source is legitimate, silent expansion from local analysis to network retrieval can expose environment metadata, create compliance issues, and cause users to process external data they did not intend to fetch.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill advertises multi-period analysis using water surface, DEM, and water level data, but the implementation never consumes reservoir boundary or water-surface inputs and instead derives synthetic masks from a single DEM plus water levels. In a geospatial decision-support context, this creates a silent integrity failure: users may trust outputs as evidence of real capacity change or sedimentation when the pipeline did not analyze the claimed source data at all.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The change-detection logic compares first-versus-last water levels on the same DEM, which does not measure morphological change, sedimentation, or capacity loss across periods. This is dangerous because it can produce plausible-looking change summaries that users may interpret as real reservoir evolution, leading to incorrect operational, engineering, or environmental decisions.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The file imports and exposes bbox/date/data-fetcher capabilities, but the main analysis path never uses them. In an agent skill, unused acquisition capabilities are risky because they misrepresent what data was actually queried or analyzed, expanding the apparent trust boundary and making provenance claims in manifests harder to trust.

Unpinned Dependencies

Low
Category
Supply Chain
Content
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
Confidence
94% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Third-party dependencies used by this skill
numpy
rasterio
Confidence
94% confidence
Finding
rasterio

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Requirements for reservoir-capacity-change
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
Confidence
96% confidence
Finding
geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
89% confidence
Finding
numpy

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.