Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0
- Confidence
- 97% confidence
- Finding
- requests>=2.28.0
Security audit
Geoskill: RS Metadata Crawler
Security checks across malware telemetry and agentic risk
Overview
The skill is a straightforward satellite-metadata search guide with only minor packaging and dependency hygiene issues, and no evidence of hidden or privileged behavior.
Before installing, expect the skill to make network requests to public satellite metadata services and write result/cache files where configured. For better reproducibility, pin or lock the requests dependency, and verify that the missing referenced crawler script is supplied by the package or workflow you intend to use.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.