Security audit

Geoskill: 流域边界划定

Security checks across malware telemetry and agentic risk

Overview

This skill performs watershed analysis with disclosed local outputs and optional public DEM download; the main cautions are dependency hygiene and network/cache awareness.

Install this only in an environment where outbound access to Microsoft Planetary Computer and local storage of DEM/cache files are acceptable. Prefer a pinned or locked dependency set, verify the provenance of geoskill-data-fetcher, and set explicit output and cache directories when processing sensitive locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documents file-writing behavior such as generating rasters, reports, and manifests, but no declared permissions are shown. Undeclared write capability can mislead operators and policy systems about what the skill will persist locally, reducing transparency and increasing the chance of unexpected filesystem changes.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest frames the skill as DEM-based local watershed delineation, but the documentation adds automatic remote download from Microsoft Planetary Computer. This hidden expansion of capability changes the trust boundary by introducing network access and third-party data retrieval that users and reviewers may not expect.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented bbox, date-range, AOI, and cache parameters introduce additional acquisition and persistence behaviors not reflected in the manifest. Undisclosed input modes and caching can cause unintended network activity and local data retention, which is a real security and privacy concern in agent environments.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This skill is described as operating on a local DEM for watershed delineation, yet it includes a shared data-download library tied to external services. That expands the attack surface by enabling unexpected network access, supply-chain risk, and possible exfiltration or retrieval of untrusted data that is not justified by the stated capability.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill describes automatic network download and writing metadata files without an explicit warning to the user. In an agent setting, silent external access and local file creation can violate user expectations, leak operational context, or create persistence artifacts without informed consent.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: Automatic data download and cache directory usage are documented, but the text does not clearly warn about network activity or persistent local storage. This is dangerous primarily because it can create unanticipated data retention and outbound requests in environments that assume offline or minimal-side-effect behavior.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 93% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 92% confidence
Finding: outlet

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy outlet rasterio
Confidence: 92% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for watershed-delineation # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 95% confidence
Finding: geoskill-data-fetcher>=0.2.0

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

Category: Supply Chain
Confidence: 82% confidence
Finding: numpy

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.