Security audit

Geoskill: Reservoir Capacity Change

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can produce reservoir change outputs from synthetic or single-DEM calculations while presenting them as multi-period capacity and sedimentation analysis.

Install only if you are comfortable treating the outputs as DEM-based modeling aids rather than verified sedimentation or true multi-period capacity-change evidence. Review generated manifests carefully, provide explicit local DEM and water-level inputs, and do not rely on bbox/date/AOI options unless the implementation is fixed to prove they affect the run.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill documentation introduces undeclared external data downloading from Microsoft Planetary Computer, which expands the trust boundary beyond the local DEM/water-level workflow described earlier. This can cause unexpected network access, remote data ingestion, and reproducibility/supply-chain risks if users invoke the skill assuming it is offline/local-only.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The documentation presents the skill as DEM-driven local analysis, but later states it will auto-download data when no DEM is supplied. This ambiguity can mislead users and security controls, resulting in unintended network activity and analysis performed on remotely sourced data instead of operator-approved local inputs.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The dependency list explicitly includes a shared data-download library and comments reference external data sources, which expands the skill's capability beyond purely local reservoir-capacity analysis. This increases attack surface through network/data-ingestion behavior and creates a mismatch between the stated skill purpose and the installed dependencies, making unintended remote access or unsafe external data handling more likely.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This is a real integrity vulnerability: the skill claims to analyze multi-period water surface data, but in practice it synthesizes water masks directly from a single DEM and water levels, ignoring the provided boundary/AOI-style observational inputs. In a geospatial analysis skill, this can mislead downstream users into treating fabricated outputs as evidence-based reservoir extent or sedimentation results, which is dangerous because the output files and manifests make the analysis look authoritative.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This is a true vulnerability because the advertised 'capacity change' and 'sedimentation trend' workflow does not compare multiple DEMs or observed area-level curves across periods; it only computes first-versus-last water level differences on the same DEM. That creates a semantic mismatch where users may infer real bathymetric or storage change over time from what is effectively a single-surface sensitivity calculation.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: This is a real but lower-severity vulnerability: the CLI exposes reservoir boundary, place, bbox, date, and fetcher-related inputs that are never used by the workflow. That can cause operators to believe the analysis was spatially/temporally scoped or auto-downloaded as requested when the outputs actually ignore those constraints, undermining trust and correctness.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy rasterio
Confidence: 94% confidence
Finding: The numpy dependency is completely unpinned, so builds may resolve to different versions over time, including versions with security defects or breaking behavior. In security-sensitive or reproducible analysis environments, this creates supply-chain risk and makes it harder to ensure the deployed version is known-safe.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio
Confidence: 92% confidence
Finding: The rasterio dependency is unpinned, allowing uncontrolled version drift and exposure to newly introduced or unresolved vulnerabilities in a package that processes complex geospatial file formats. Because this skill likely ingests raster data, dependency instability and parser-related flaws are more relevant than in a simple utility package.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for reservoir-capacity-change # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 96% confidence
Finding: Using geoskill-data-fetcher>=0.2.0 permits any later version, which is effectively unbounded and can introduce unreviewed code paths or security regressions. Because this package appears to enable network data acquisition, unpinned upgrades carry elevated supply-chain and remote-input risk compared with a purely local library.

Static analysis

No suspicious patterns detected.