Geoskill: World Boundary Download

• Outcome: Review
• Latest audit: Aug 1, 2026 · 7:05 AM UTC
• Version: 3.0.0

Overview

The skill appears to be a legitimate boundary-data downloader, but the submitted package is incomplete and has risky dependency/install ambiguity that should be reviewed before installation.

Review or fix the package before installing: include the missing local `core` modules, remove or justify the bare `core` dependency, pin dependencies to known-safe versions, and make GADM fallback/license notices explicit when fallback happens automatically.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The skill documents an automatic fallback chain that may silently switch from geoBoundaries to GADM, while separately stating that the GADM license notice appears only when users explicitly select GADM. This can cause users to unknowingly receive data under more restrictive non-commercial terms, creating compliance, legal, and downstream redistribution risk in commercial or mixed-use workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

core
geopandas>=0.12.0
pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0

• Confidence: 96% confidence
• Finding: `geopandas>=0.12.0` is unpinned and the minimum version range includes `0.12.0`, which static analysis identifies as a known vulnerable release. In a skill that downloads and processes external geospatial data, using a dependency range that permits known-bad versions increases supply-chain and exploitation risk if an environment resolves to the vulnerable version.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.3.0
pycountry>=22.3.5
pyogrio>=0.5.0
requests>=2.28.0
shapely>=1.8.0
topojson>=1.0

• Confidence: 97% confidence
• Finding: `requests>=2.28.0` is unpinned and explicitly allows installation of `2.28.0`, which the scanner flags as affected by multiple advisories. Because this skill downloads remote data, reliance on a range that includes a known vulnerable HTTP client library is more dangerous than in a purely local/offline skill.

Known Vulnerable Dependency: geopandas==0.12.0 — 2 advisory(ies): CVE-2025-69662 (geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclos); CVE-2025-69662 (SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to ob)

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The allowed dependency floor includes `geopandas==0.12.0`, and the scanner reports a critical SQL injection vulnerability affecting that version in `to_postgis()`. Even if this skill primarily downloads boundary files, packaging a version range that can resolve to a critically vulnerable release is dangerous because downstream usage or future code changes may invoke the affected functionality, and geospatial ETL workflows commonly interact with databases.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The allowed dependency set includes `requests==2.28.0`, which is flagged with multiple advisories including credential leakage and verification-related issues. This skill's purpose is to fetch remote boundary data, so weaknesses in the HTTP client are especially relevant because they may expose credentials, weaken transport assurances, or mishandle attacker-controlled URLs during downloads.

Static analysis

No suspicious patterns detected.