torch-geometric

ISSUES FOUND max severity HIGHSkillSpector Caution 8 registry K-Dense-AI last scanned 1 scan

4 findings (4 high), mainly command injection. Most recent scan 2026-10-21.

Findings4
Critical0
High4
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 8
Score8 / 100
Issues5
CategoriesData Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Supports PyTorch Geometric (PyG) graph neural networks — node/link/graph classification, message passing (GCN, GAT, GraphSAGE, GIN), heterogeneous graphs, neighbor sampling, and custom datasets. Use when working with torch_geometric, not for general NetworkX analytics or non-graph PyTorch models.

Package
8 files, 84 KB
SKILL.md
2519 words, 12+ sections
Code
None. Instructions only.
License
MIT license
Compatibility
Requires Python 3.10+, PyTorch 2.9+, and torch-geometric 2.8.0.post1. Optional pyg-lib, torch-scatter and torch-sparse wheels must match Python, OS, PyTorch and CUDA/CPU. Network access is needed only for installation and dataset/model downloads.

SKILL.md covers: PyTorch Geometric (PyG) · Installation · Install the PyTorch build for your platform from https://pytorch.org/get-started/locally/ · Core Concepts · Graph Data: `Data` and `HeteroData` · If edges are [[src1, dst1], [src2, dst2], ...] — transpose first: · Datasets · Single-graph node classification (Cora, Citeseer, Pubmed) · Multi-graph classification (ENZYMES, MUTAG, IMDB-BINARY, etc.) · dataset[0], dataset[1], ... are individual graphs · Transforms · Common transforms

Findings

HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in SKILL.md at line 226 contains potentially dangerous Python code.

SKILL.md:226

model.eval()  # Module evaluation behavior; gradients are disabled separately.
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/explainability.md at line 112 contains potentially dangerous Python code.

references/explainability.md:112

model.eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/link_prediction.md at line 78 contains potentially dangerous Python code.

references/link_prediction.md:78

model.eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/link_prediction.md at line 123 contains potentially dangerous Python code.

references/link_prediction.md:123

model.eval()
Remediation: Review the code block for security implications.

What is in the package

FileKindSize
SKILL.mddoc22 KB
references/custom_datasets.mddoc10 KB
references/explainability.mddoc8.6 KB
references/heterogeneous.mddoc9.1 KB
references/link_prediction.mddoc11 KB
references/message_passing.mddoc5.0 KB
references/review.mddoc7.0 KB
references/scaling.mddoc11 KB

External hosts referenced

pytorch-geometric.readthedocs.io data.pyg.org github.com ogb.stanford.edu arxiv.org sbert.net 3dvision.princeton.edu captum.ai deepchemdata.s3-us-west-1.amazonaws.com doi.org export.arxiv.org faust.is.tue.mpg.de modelnet.cs.princeton.edu pypi.org pytorch.org raw.githubusercontent.com shapenet.cs.stanford.edu snap.stanford.edu www.chrsmrrs.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills