Security audit

Solar Energy Potential

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent solar-energy calculator that uses user-provided coordinates or CSV rows to query NASA POWER and write requested output files.

Before installing, be aware that latitude/longitude values, including rows from a batch CSV, are sent to NASA POWER. Avoid using sensitive private site lists unless that external API use is acceptable, and prefer installing with a current patched requests version or a lockfile.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation advertises and instructs use of capabilities that read local CSV files, write output files, and make outbound network requests to the NASA POWER API, but it does not declare corresponding permissions. This creates a transparency and governance gap: users or platforms may approve the skill without understanding that local data will be accessed and transmitted externally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill sends user-supplied coordinates and potentially batch CSV location data to an external third-party API, but the description does not clearly warn users about this data egress. Even if coordinates seem low sensitivity, batch site data can reveal business plans, asset locations, or private addresses, so omission of the warning undermines informed consent and privacy review.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.21.0 requests>=2.28.0
Confidence: 95% confidence
Finding: numpy>=1.21.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.21.0 requests>=2.28.0
Confidence: 98% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: requests==2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_solar-energy-potential.py:16