esm

ISSUES FOUND max severity HIGHSkillSpector Caution 32 registry K-Dense-AI last scanned 1 scan

4 findings (4 high), mainly command injection. Most recent scan 2026-10-21.

Findings4
Critical0
High4
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 32
Score32 / 100
Issues2
Categoriesanalysis-evasion Output Handling
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Uses the Biohub esm Python SDK for ESM3 protein generation, ESMC embeddings, and ESMFold2 all-atom folding. Applies to local model inference and Biohub hosted clients, including former Forge workflows; distinguishes the separate legacy fair-esm distribution.

Package
8 files, 53 KB
SKILL.md
1203 words, 11 sections
Code
Python (1)
License
MIT license
Compatibility
Requires Python 3.12+ and esm 3.4.1.post1. Local pretrained inference needs model weights and sufficient RAM or GPU memory; hosted inference needs network access and ESM_API_KEY. Use an isolated environment, separate from fair-esm.

SKILL.md covers: ESM: protein generation, embeddings, and folding · When to use · Setup and model choice · Workflow · ESM3 completion and fresh structure prediction · A fresh sequence-only prompt prevents old coordinates conditioning the check. · ESMC embeddings with correct residue pooling · Hosted authentication and folding · Scientific checks · Verification and sources · Citing Scientific Agent Skills

Findings

HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in SKILL.md at line 109 contains potentially dangerous Python code.

SKILL.md:109

model = EsmcForMaskedLM.from_pretrained("biohub/ESMC-300M", device="cpu").eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/biohub-platform.md at line 77 contains potentially dangerous Python code.

references/biohub-platform.md:77

model = EsmFold2Model.from_pretrained("biohub/ESMFold2", device="cuda").eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/esm-c-api.md at line 15 contains potentially dangerous Python code.

references/esm-c-api.md:15

model = EsmcForMaskedLM.from_pretrained("biohub/ESMC-300M", device="cpu").eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/esm-c-api.md at line 68 contains potentially dangerous Python code.

references/esm-c-api.md:68

)).eval()
Remediation: Review the code block for security implications.

What is in the package

FileKindSize
SKILL.mddoc10 KB
references/biohub-platform.mddoc5.3 KB
references/esm-c-api.mddoc6.5 KB
references/esm3-api.mddoc6.5 KB
references/forge-api.mddoc6.9 KB
references/review.mddoc5.9 KB
references/workflows.mddoc7.1 KB
scripts/esm_embeddings.pyscript4.6 KB

External hosts referenced

github.com biohub.ai huggingface.co scikit-learn.org pypi.org arxiv.org biohub.org doi.org export.arxiv.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

ESM_API_KEY

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills