Security audit

Geoskill: 湿地变化监测

Security checks across malware telemetry and agentic risk

Overview

This skill performs disclosed wetland analysis and optional geospatial data downloads, with ordinary dependency and network-use cautions but no evidence of hidden or malicious behavior.

Before installing, be aware that bbox/date-range mode can contact Microsoft Planetary Computer and transmit the requested area and dates, then store downloaded data locally, including in the configured cache. Use local raster inputs or a controlled cache/output directory if the area of interest is sensitive, and prefer pinned dependencies for reproducible deployments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill’s stated purpose is local wetland change analysis, but it also performs remote STAC discovery and asset downloads from external services. This creates unexpected network behavior, sends AOI/date metadata off-host, and expands the trust boundary beyond what a user may reasonably infer from the skill description.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The shared downloader introduces a generic remote-fetch capability that is broader than the analytical task itself and relies on external library behavior the script does not tightly constrain. Even though this file requests specific collections, importing and trusting a repo-local or pip-installed helper increases supply-chain and unintended network-exfiltration risk.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: This section states the skill can automatically download remote datasets and write metadata to output-manifest.json without an explicit warning that invoking this mode causes network access and local filesystem changes. That can surprise users, violate least-surprise expectations, and create privacy or policy issues in restricted environments.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The later section explicitly says that providing only --bbox and --date-range triggers automatic downloading and cached/local writes, but it still lacks a clear safety warning about network activity, cache usage, and filesystem side effects. In automated or sandboxed agent contexts, undocumented side effects can lead to policy violations or unintended data egress.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow automatically reaches out to remote services when local inputs are missing and only surfaces this behavior during execution, not as an upfront warning or explicit consent step. In security-sensitive or privacy-sensitive environments, silent network access can leak AOI, date range, and usage patterns and violate operator expectations or policy.

Unpinned Dependencies

Low

Category: Supply Chain
Content: geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy rasterio scipy shapely
Confidence: 97% confidence
Finding: numpy

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio scipy shapely
Confidence: 97% confidence
Finding: rasterio

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Third-party dependencies used by this skill numpy rasterio scipy shapely
Confidence: 97% confidence
Finding: scipy

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy rasterio scipy shapely
Confidence: 97% confidence
Finding: shapely

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Requirements for wetland-change-monitor # Shared data-download library (Planetary Computer / NASA POWER / OSM) geoskill-data-fetcher>=0.2.0 # Third-party dependencies used by this skill numpy
Confidence: 99% confidence
Finding: geoskill-data-fetcher>=0.2.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.