Security audit

Sentinel Downloader

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Sentinel imagery downloader with expected network, disk, and optional dependency setup behavior.

Install only if you are comfortable with a tool that contacts external STAC services, can download large imagery files to your chosen output directory, and may install Python packages if you run --check-deps. Use a virtual environment and a small --limit first if disk or bandwidth matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes network-capable behavior against external STAC API endpoints, but no declared permissions are present to inform users or enforcement layers that outbound network access is required. This weakens transparency and policy control, making it easier for a skill to perform external requests without explicit review, even though the described use case itself appears legitimate.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The wrapper script automatically installs Python packages with pip when imports fail, which changes the host environment and performs network/package operations beyond simple imagery download behavior. This is risky because users invoking a downloader may not expect dependency installation side effects, and package installation can introduce unreviewed code execution via package install hooks or altered runtime state.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script can modify the host by invoking pip3/pip to install packages, which is not necessary for the core task of calling an existing downloader and expands the skill's capabilities beyond its stated purpose. In agent or automation contexts, this increases risk because it permits persistent environment changes and execution of third-party package installation logic on the user's machine.

Missing User Warnings

Low

Confidence: 71% confidence
Finding: The README advertises batch downloads and writing imagery to a user-specified output directory, but it does not warn about local file creation, large storage consumption, or bandwidth impact. In a downloader skill, this omission can lead to unexpected disk exhaustion or unintended writes, especially when users invoke broad searches or batch operations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Dependency installation is triggered without an explicit up-front warning that the command may download packages and modify the Python environment. This is dangerous because users may run the skill expecting read/download-only behavior, while pip operations can fetch remote content, alter interpreter state, and create persistence on the host.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 93% confidence
Finding: requests>=2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.