Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
h5netcdf>=1.0.0 netCDF4>=1.6.0 numpy>=1.21.0 rasterio>=1.3.0
- Confidence
- 89% confidence
- Finding
- h5netcdf>=1.0.0
Security audit
Netcdf Toolkit
Security checks across malware telemetry and agentic risk
Overview
This skill is a local NetCDF/HDF data-conversion toolkit with no evidence of hidden upload, persistence, credential access, or unrelated behavior.
Before installing, consider using a virtual environment and pinned dependency set, especially because geospatial libraries can be large and complex. The tool appears to process data locally and only writes outputs you request, but those output paths may overwrite existing files if reused.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
h5netcdf>=1.0.0 netCDF4>=1.6.0 numpy>=1.21.0 rasterio>=1.3.0
- Confidence
- 89% confidence
- Finding
- netCDF4>=1.6.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
h5netcdf>=1.0.0 netCDF4>=1.6.0 numpy>=1.21.0 rasterio>=1.3.0
- Confidence
- 91% confidence
- Finding
- numpy>=1.21.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
h5netcdf>=1.0.0 netCDF4>=1.6.0 numpy>=1.21.0 rasterio>=1.3.0
- Confidence
- 90% confidence
- Finding
- rasterio>=1.3.0
VirusTotal
62/62 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/test_netcdf-toolkit.py:15