Geoskill: River Morphology Change

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:16 PM UTC
• Version: 2.0.0

Overview

This skill is not evidently malicious, but it needs Review because it can make network downloads and persistent cache writes that are only partially disclosed, and a no-input run can produce demo analysis outputs.

Install only if you are comfortable with the skill making outbound requests to Microsoft Planetary Computer, downloading imagery, and creating a persistent cache. Prefer explicit local --input-masks for real work, choose a controlled --output-dir and --cache-dir, and treat outputs from runs without real inputs as demo data unless the skill is fixed to require an explicit demo mode.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill documentation indicates file-writing behavior (multiple output artifacts and cache/output directories) but does not declare corresponding permissions. Undeclared write capability weakens least-privilege controls and can surprise hosts that rely on metadata to sandbox or approve skills. In this context, the risk is elevated because the skill also supports automatic data acquisition and caching, increasing the volume and locations of filesystem writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose says the skill analyzes provided water masks, but later content adds remote STAC search and automatic imagery download from Microsoft Planetary Computer. This hidden expansion of capability changes the trust model from offline/local analysis to networked data acquisition, which can trigger unexpected outbound requests, local caching, provenance collection, and larger attack surface than operators expect.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file presents the skill primarily as input-mask analysis, then later states it can automatically download imagery/data. This inconsistency can mislead reviewers and users into approving or invoking a skill with network behavior they did not intend, especially in restricted or offline environments.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The skill description is limited to processing provided water body masks, yet the requirements include a shared data-download library tied to external sources. This expands the attack surface and grants unnecessary network/data access capability, which is risky because excess capability can be abused directly or through supply-chain compromise.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: An unjustified external data-fetching dependency violates least privilege for a morphology-analysis skill. Even without direct evidence of malicious use in this file, unnecessary fetch capability increases exposure to data exfiltration, remote content handling risks, and downstream dependency compromise.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script can perform an external Sentinel-2 download when bbox/date arguments are present, even though the skill description centers on analyzing provided water masks. This introduces unexpected network access and rewrites an input-related argument (`args.image`), creating hidden data-flow and side effects that can violate user expectations, privacy boundaries, or offline/sandbox assumptions.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: If no input masks are supplied, the tool silently generates synthetic demo data and proceeds as though analysis succeeded. In a decision-support or automated pipeline context, this can produce fabricated outputs that may be mistaken for real morphology results, undermining integrity and potentially contaminating downstream reporting.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes automatic remote downloads and local caching without a clear warning that invoking certain arguments causes network egress and persistent local writes. In security-sensitive environments, silent network activity and cache persistence can violate policy, expose usage patterns, or consume storage unexpectedly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill performs automatic network retrieval and writes multiple output artifacts without a strong, explicit warning at the action point. In agent or pipeline environments, hidden network and filesystem side effects are dangerous because they can leak area-of-interest metadata to third parties, consume resources, and create persistent artifacts unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
scipy
shapely

• Confidence: 93% confidence
• Finding: The numpy dependency is unpinned, so installs may resolve to different versions over time, including unexpectedly vulnerable or breaking releases. This weakens reproducibility and makes the environment more susceptible to supply-chain and dependency-drift issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy
shapely

• Confidence: 93% confidence
• Finding: The rasterio dependency is unpinned, which allows uncontrolled version resolution during installation. That can introduce vulnerable builds, incompatible behavior, or malicious package substitution in less controlled environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy
shapely

• Confidence: 93% confidence
• Finding: The scipy dependency is unpinned, creating avoidable supply-chain and reproducibility risk. Since scientific packages often include native code, uncontrolled version changes can have security and stability consequences beyond simple API drift.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy
rasterio
scipy
shapely

• Confidence: 92% confidence
• Finding: The shapely dependency is unpinned, allowing future installs to pull arbitrary newer versions with different security or runtime characteristics. While not proof of exploitation by itself, this is a real hardening gap in dependency management.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for river-morphology-change
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 95% confidence
• Finding: geoskill-data-fetcher is only minimally constrained with a lower bound, meaning any later version may be installed. Because it is a network-capable shared data-download library, loose versioning is especially risky: a compromised or unsafe later release could materially expand attack surface.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: The requirement for numpy is unversioned, and static analysis indicates multiple historical advisories affecting some numpy releases. Because no safe minimum or exact version is specified, the environment could resolve to a vulnerable version depending on installer behavior, mirrors, or existing constraints.

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: The scipy dependency is unpinned and static analysis reports known advisories in historical scipy versions. This means a vulnerable release could be installed unintentionally, which is particularly concerning for packages with compiled components and file-system interactions.

Static analysis

No suspicious patterns detected.