Security audit

Rs Index Calc

Security checks across malware telemetry and agentic risk

Overview

This skill is a local GeoTIFF calculator that reads user-provided imagery and writes calculated output files without network access or hidden persistence.

Installers should expect this skill to read GeoTIFF files they point it at and create result TIFFs in the chosen output location. Custom formulas are parsed with a restricted AST evaluator rather than Python eval, and no network behavior or credential handling was found.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.obfuscated_code

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: rs-index-calc.py:32

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/conftest.py:13

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_security.py:22

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: tests/test_security.py:71