geo-intelligence

Warn

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Extensive use of the subprocess module across multiple scripts to orchestrate analysis and interact with system tools.
  • accel.py runs nvidia-smi, powershell, and uv to manage GPU acceleration environments.
  • net.py, osm.py, pano.py, and gsv.py use curl to fetch data from various external geospatial APIs.
  • recon.py and photo_session.py use uv run to execute other scripts in the suite.
  • meta.py executes exiftool to extract deep metadata from images.
  • [DYNAMIC_EXECUTION]: Several scripts employ dynamic execution patterns for performance or functionality.
  • textgeo.py and geodata.py use pickle.load() to deserialize local cache files (cities500.v3.pkl), which is unsafe if the cache files are tampered with.
  • accel.py performs dynamic environment setup by running uv pip install to configure a GPU-accelerated environment at runtime.
  • Static analysis identifies the use of eval() in sat_scan.py and match.py for coordinate or geometric processing.
  • [EXTERNAL_DOWNLOADS]: The skill downloads significant external resources from well-known and research-oriented sources.
  • Fetches local ML models (approx. 6.2 GB) from Hugging Face (StreetCLIP, GeoCLIP, OWLv2, etc.).
  • Downloads the GeoCalib library directly from a GitHub repository at runtime.
  • Fetches geospatial data from OpenStreetMap (Overpass), GeoNames, and Socrata open-data portals.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where untrusted data from images is ingested into the agent's context.
  • Ingestion points: ocr.py and intake.py extract text from user-supplied images.
  • Boundary markers: The instructions in SKILL.md remind the agent to treat metadata and extracted text as hypotheses, but explicit delimiters for OCR output are not strictly enforced.
  • Capability inventory: The skill has significant capabilities including network access, file system writes, and subprocess execution across all 38 scripts.
  • Sanitization: Extracted text is used to construct queries for poi.py and textgeo.py, creating a path for potential injection if the LLM interprets text as instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 22, 2026, 12:06 PM