Geoskill: Urban Expansion Monitor

• Outcome: Review
• Latest audit: Jul 31, 2026 · 12:44 PM UTC
• Version: 2.0.0

Overview

The skill is not deceptive or destructive, but its auto-download mode can produce urban-expansion reports from raw satellite bands that do not match the built-up raster inputs the analysis expects.

Install only if you are comfortable reviewing or disabling the auto-download path. For reliable results, provide validated built-up rasters yourself, pin and audit dependencies, and avoid treating bbox/date auto-generated reports as planning-grade outputs until the skill adds a real built-up classification step and input validation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The auto-download path claims to obtain suitable before/after inputs, but it actually downloads raw Landsat assets and passes one asset path directly into logic that expects built-up rasters. This can silently produce misleading outputs and reports, which is dangerous in a geospatial analysis skill because users may trust the generated urban expansion metrics for planning or decision-making.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The module advertises comparison of built-up area rasters, but the optional downloader path feeds raw Landsat bands into the same threshold-based change detector without converting them into built-up masks. This semantic mismatch can yield materially false urban expansion conclusions while appearing successful, creating integrity risk rather than direct code execution risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 97% confidence
• Finding: The dependency on `numpy` is unpinned, so installs may resolve to different versions over time, reducing reproducibility and increasing the chance of unexpectedly pulling a vulnerable or incompatible release. In a package manifest, this is a real supply-chain risk even if not immediately exploitable on its own.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Third-party dependencies used by this skill
numpy
rasterio

• Confidence: 97% confidence
• Finding: The dependency on `rasterio` is unpinned, which allows builds to drift to arbitrary newer releases and can introduce vulnerable or breaking versions without code changes. This is a genuine dependency hygiene issue and part of the software supply-chain attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Requirements for urban-expansion-monitor
# Shared data-download library (Planetary Computer / NASA POWER / OSM)
geoskill-data-fetcher>=0.2.0

# Third-party dependencies used by this skill
numpy

• Confidence: 98% confidence
• Finding: Using `geoskill-data-fetcher>=0.2.0` permits any future version above the minimum, including versions that may introduce security regressions or malicious compromise. This is especially relevant here because it is a shared data-download library, so compromise could affect network retrieval and downstream data handling across skills.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: `numpy` is declared without a version, and the static finding associates the package name with multiple historical advisories. Because no concrete version is pinned, it is impossible to prove from this file alone that a vulnerable version will be installed, but the manifest does allow vulnerable versions depending on resolver behavior and environment, so this remains a real exposure rather than a pure false positive.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/urban_expansion_monitor.py:74