Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fiona>=1.8.0 numpy>=1.21.0 rasterio>=1.3.0 scipy>=1.7.0
- Confidence
- 95% confidence
- Finding
- fiona>=1.8.0
Security audit
water-body-extraction
Security checks across malware telemetry and agentic risk
Overview
This skill appears to be a local satellite-image processing tool with ordinary geospatial dependencies and no evidence of hidden network, credential, persistence, or destructive behavior.
Install it in a controlled Python environment and consider pinning the dependencies before production use. Run it only on imagery and output directories you choose, and verify documentation examples against `--help` because a few advanced flags appear to be documented but not implemented.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fiona>=1.8.0 numpy>=1.21.0 rasterio>=1.3.0 scipy>=1.7.0 shapely>=1.8.0
- Confidence
- 95% confidence
- Finding
- numpy>=1.21.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fiona>=1.8.0 numpy>=1.21.0 rasterio>=1.3.0 scipy>=1.7.0 shapely>=1.8.0 tqdm>=4.64.0
- Confidence
- 94% confidence
- Finding
- rasterio>=1.3.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fiona>=1.8.0 numpy>=1.21.0 rasterio>=1.3.0 scipy>=1.7.0 shapely>=1.8.0 tqdm>=4.64.0
- Confidence
- 95% confidence
- Finding
- scipy>=1.7.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
numpy>=1.21.0 rasterio>=1.3.0 scipy>=1.7.0 shapely>=1.8.0 tqdm>=4.64.0
- Confidence
- 93% confidence
- Finding
- shapely>=1.8.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
rasterio>=1.3.0 scipy>=1.7.0 shapely>=1.8.0 tqdm>=4.64.0
- Confidence
- 94% confidence
- Finding
- tqdm>=4.64.0
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/test_water-body-extraction.py:17