deepchem
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches dependencies from PyPI and model assets from Hugging Face Hub, targeting established organizations such as IBM Research and the DeepChem project.
- [REMOTE_CODE_EXECUTION]: The fine-tuning script supports loading models that require custom repository code via the
trust_remote_codeparameter. This is mitigated by a mandatory check for a pinned 40-character commit SHA inscripts/transfer_learning.py, preventing the execution of unreviewed or modified remote code. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided CSV files containing SMILES strings and assay labels. Ingestion is protected by data validation checks in
scripts/_common.py, including SMILES parsing via RDKit and finite numeric label verification.
Audit Metadata