torchdrug

ISSUES FOUND max severity HIGHSkillSpector Caution 45 registry K-Dense-AI last scanned 1 scan

4 findings (4 high), mainly command injection. Most recent scan 2026-10-21.

Findings4
Critical0
High4
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 45
Score45 / 100
Issues4
Categoriesanalysis-evasion Data Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Builds and troubleshoots TorchDrug 0.2.1 workflows for molecular graphs, property prediction, self-supervised pretraining, molecule generation, retrosynthesis, protein representation learning, and knowledge graph reasoning. Use when code imports torchdrug or needs its datasets, models, tasks, or Engine.

Package
10 files, 76 KB
SKILL.md
1314 words, 12+ sections
Code
None. Instructions only.
Allowed tools
Read Write Edit Bash
License
Apache-2.0 license
Compatibility
Requires Python 3.7-3.10, PyTorch 1.8-2.0, compatible torch-scatter/torch-cluster, RDKit, and fair-esm. Apple Silicon is CPU-only and requires native builds; MPS is unsupported. Network access is needed for uncached datasets and weights.

SKILL.md covers: TorchDrug · Start with the version guard · Installation · Canonical property-prediction workflow · Choose the official workflow · Molecular property prediction · Self-supervised molecular pretraining · Molecule generation · Retrosynthesis · Knowledge graph reasoning · Protein modeling · Rules for reliable TorchDrug code

Findings

HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/molecular_generation.md at line 74 contains potentially dangerous Python code.

references/molecular_generation.md:74

task.eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/molecular_generation.md at line 201 contains potentially dangerous Python code.

references/molecular_generation.md:201

task.eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/molecular_property_prediction.md at line 118 contains potentially dangerous Python code.

references/molecular_property_prediction.md:118

task.eval()
Remediation: Review the code block for security implications.
HIGH Python code block uses eval/exec Command Injectionbehavioral

Code block in references/retrosynthesis.md at line 193 contains potentially dangerous Python code.

references/retrosynthesis.md:193

task.eval()
Remediation: Review the code block for security implications.

What is in the package

FileKindSize
SKILL.mddoc12 KB
references/core_concepts.mddoc7.3 KB
references/datasets.mddoc8.9 KB
references/knowledge_graphs.mddoc5.8 KB
references/models_architectures.mddoc5.6 KB
references/molecular_generation.mddoc6.2 KB
references/molecular_property_prediction.mddoc7.3 KB
references/protein_modeling.mddoc8.2 KB
references/retrosynthesis.mddoc7.4 KB
references/review.mddoc7.1 KB

External hosts referenced

torchdrug.ai github.com arxiv.org data.pyg.org deepchemdata.s3-us-west-1.amazonaws.com docs.astral.sh doi.org export.arxiv.org pypi.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills