Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
- Confidence
- 94% confidence
- Finding
- requests>=2.28.0
Security audit
VIIRS Nightlights Downloader
Security checks across malware telemetry and agentic risk
Overview
This skill is a straightforward public-data downloader, with dependency hygiene issues but no evidence of hidden or purpose-mismatched behavior.
Reasonable to install for downloading public VIIRS datasets, but use a virtual environment and pin or constrain dependencies to current patched versions before use. Be aware that downloads can overwrite files when --force is used and may create large local data files in the chosen output directory.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
- Confidence
- 92% confidence
- Finding
- tqdm>=4.64.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
- Confidence
- 91% confidence
- Finding
- pytest>=7.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.28.0 tqdm>=4.64.0 pytest>=7.0.0 pytest-cov>=4.0.0
- Confidence
- 91% confidence
- Finding
- pytest-cov>=4.0.0
Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
- requests==2.28.0
Known Vulnerable Dependency: tqdm==4.64.0 — 2 advisory(ies): CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2024-34062 (tqdm CLI arguments injection attack)
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
- tqdm==4.64.0
Known Vulnerable Dependency: pytest==7.0.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
- pytest==7.0.0
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/conftest.py:15