Security audit

Geoskill: Sentinel-1 Download

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Sentinel-1 public imagery search/download helper with disclosed network use and local file output.

Before installing, note that the package appears to document a downloader but does not include the referenced sentinel1-download.py script in the inspected artifact. If a script is supplied from another source, review it separately. Consider pinning the requests dependency for reproducible installs.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only (`requests>=2.28.0`), which permits installation of different versions over time and weakens reproducibility and supply-chain control. This can unexpectedly pull in vulnerable or behavior-changing releases depending on environment and resolution time, making security review and incident response harder.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.