Security audit

Geoskill: Tailings Dam Risk

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated purpose, but it needs Review because it can produce tailings-dam risk reports using synthetic fallback data when real inputs or downloads are missing.

Review before installing for operational use. Run it only where geospatial file access, local report generation, cache writes, and optional public data downloads are acceptable; provide real DEM and water-mask inputs for serious analysis, treat any synthetic or incomplete-data output as demo/screening-only, and pin dependencies before production deployment.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes reading input files and writing multiple outputs, and it also states that data may be auto-downloaded, yet no permissions are declared. This creates a real trust and policy gap: operators cannot accurately assess what filesystem or external data access the skill requires, increasing the chance of unintended data exposure, unauthorized file writes, or execution in an over-privileged environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior goes beyond the high-level description by performing external downloads, ingesting additional datasets, computing impact/runout products, and generating multiple reports and artifacts without corresponding permission or behavior declarations. In a security review context, this mismatch is dangerous because users may invoke the skill expecting limited local screening while it performs broader I/O and network activity, which weakens informed consent, auditing, and sandboxing decisions.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill can present itself as performing remote-sensing change detection while auto-download mode may obtain only one Sentinel-2 scene and then silently fall back to synthetic DEM/water-mask data when inputs are missing. In a tailings-dam safety context, this is dangerous because operators may act on fabricated or non-observational outputs, producing false reassurance or misprioritized patrols for critical infrastructure.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script performs automatic remote downloads and writes multiple local output artifacts without an explicit up-front consent or clear operator warning. In many agent or enterprise environments, unexpected network egress and filesystem writes can violate execution assumptions, leak sensitive AOI metadata to third-party services, or create compliance issues even if the destinations are legitimate.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy rasterio shapely
Confidence: 97% confidence
Finding: The dependency is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a bad or incompatible release is published. In a remote-sensing skill that processes external geospatial data, dependency drift can affect both security posture and operational reliability.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio shapely
Confidence: 97% confidence
Finding: rasterio is declared without a fixed version, which makes dependency resolution non-deterministic and can introduce vulnerable or breaking releases into deployments. Because this skill handles geospatial raster inputs, library changes may expand attack surface through parsing behavior and native-code dependencies.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio shapely
Confidence: 97% confidence
Finding: shapely is unpinned, creating a supply-chain and reproducibility weakness where future installs may silently pick up unexpected versions. Since shapely is used for geometry handling, version drift could introduce parser-related bugs or security issues in processing untrusted spatial inputs.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for tailings-dam-risk # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 98% confidence
Finding: The shared data-download library is only lower-bounded (>=0.2.0), so any later version may be installed, including unreviewed or compromised releases. This is more concerning than a purely local math library because the package likely interfaces with external services and data retrieval, increasing exposure to supply-chain compromise and behavioral drift.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 78% confidence
Finding: Using numpy without a version constraint means dependency resolution could select versions affected by known advisories, leaving the environment exposed to historical flaws until package selection is controlled. The practical risk depends on the resolved version and exploitability in this deployment, but in a data-processing skill it is unsafe to leave a widely used package unconstrained when advisories exist.

Static analysis

No suspicious patterns detected.