esm
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads official model weights and software from trusted sources including PyPI (esm package), Hugging Face (biohub/ESMC-*, biohub/ESMFold2), and GitHub (Biohub/esm). These are recognized industry-standard repositories for biological research software.
- [DATA_EXFILTRATION]: Communication is directed to the official Biohub API (biohub.ai). Sensitive credentials like API keys are correctly managed via environment variables (ESM_API_KEY), preventing hardcoded secrets in the code or instructions.
- [COMMAND_EXECUTION]: Setup instructions use standard package managers (uv, pip) to install pinned versions of dependencies. The skill encourages isolated environments to prevent dependency conflicts with legacy ESM distributions.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data such as protein sequences and PDB structure files. It provides validation scripts (scripts/esm_embeddings.py) to check sequence integrity and ensure inputs conform to expected scientific vocabularies before processing.
- [DYNAMIC_EXECUTION]: The skill utilizes the official ESM SDK for model inference. While the SDK handles complex data serialization (tensors, PDB files), it does so using established scientific data formats and standard library functions without exposing unsafe dynamic execution paths.
Audit Metadata