Geoskill: Road Accessibility Analysis

• Outcome: Review
• Latest audit: Jul 31, 2026 · 9:38 AM UTC
• Version: 3.0.0

Overview

This skill performs disclosed road-network analysis with expected local file outputs and optional public data downloads.

Before installing, review whether automatic public data downloads are acceptable in your environment and consider pinning dependencies for reproducible deployments. Run the tool with an explicit output directory and avoid using sensitive input paths if the manifest should not record them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation indicates capabilities to read inputs and write outputs to disk, but it does not declare permissions or clearly scope those filesystem actions. This can lead to users or orchestrators invoking the skill without understanding that local files will be accessed and created, increasing the risk of unintended data exposure or overwriting files in the execution environment.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill can automatically download external datasets and persist outputs and metadata, but the description does not prominently disclose this behavior as a side effect. Hidden network access and disk writes reduce informed consent and may violate expectations in restricted or sensitive environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: numpy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: rasterio

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio
scipy

• Confidence: 91% confidence
• Finding: scipy

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for road-accessibility-analysis
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 94% confidence
• Finding: geoskill-data-fetcher>=0.2.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/road_accessibility_analysis.py:145