Security audit

Geoskill: Watershed Delineation

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a normal watershed analysis tool, with disclosed local output creation and an optional public DEM download mode.

Install this if you are comfortable with a geospatial tool that writes output rasters/reports locally and may contact Microsoft Planetary Computer to download public DEM data when invoked with bbox or AOI inputs. For stricter environments, pin dependencies and restrict output/cache directories and network access.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents local file creation (`.tif`, `.html`, and `output-manifest.json`) but does not declare permissions for file writes. In an agent setting, undeclared write capability reduces transparency and can lead to unexpected filesystem modifications, especially when output paths are user-controlled.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The manifest describes a DEM-processing skill, but the documentation also includes automatic remote data acquisition and synthetic data generation, which are materially different behaviors. This mismatch can mislead operators and policy engines, causing unexpected network access or execution paths in environments that only approved local geoprocessing.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented behavior expands from local watershed delineation to downloading DEM/data over the network, but that network behavior is not clearly reflected in the skill’s stated scope. Hidden or under-disclosed network access is dangerous because it can bypass user expectations, governance controls, and offline-only assumptions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill manifest describes local watershed delineation from a DEM, but the requirements introduce a shared data-download library with access to external sources such as Planetary Computer, NASA POWER, and OSM. That mismatch expands the skill's capabilities beyond its stated purpose, increasing the risk of unexpected network access, data exfiltration paths, or hidden behavior that reviewers and users would not anticipate.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: A dependency that enables remote data fetching is not justified by the stated watershed-only functionality in this file. In security-sensitive agent environments, unjustified network-capable dependencies enlarge the attack surface and can be abused for unreviewed outbound requests or retrieval of untrusted content.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents automatic remote downloads and local manifest/output creation without a clear warning or explicit consent model. In agent workflows, silent network access and filesystem writes can expose metadata, consume resources, or create artifacts users did not expect.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 86% confidence
Finding: The numpy dependency is unpinned, so builds may resolve to different versions over time, including versions with security defects or breaking changes. This undermines reproducibility and increases supply-chain risk because the exact package contents are not fixed.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 84% confidence
Finding: The outlet dependency is unpinned, allowing uncontrolled version drift during installation. That creates supply-chain risk and can introduce vulnerable or incompatible releases without code changes in the skill itself.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 84% confidence
Finding: The rasterio dependency is unpinned, which weakens reproducibility and can silently introduce vulnerable upstream versions. For a geospatial processing skill, this may also pull in varying native/library combinations with different security and stability properties.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for watershed-delineation # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 88% confidence
Finding: geoskill-data-fetcher is only partially constrained with a lower bound, which still permits installation of many future versions that have not been reviewed. Because this package appears to provide external data access, loose versioning increases both supply-chain and unexpected capability risk.

Static analysis

No suspicious patterns detected.