matchms
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill prioritizes security by providing clear documentation and implementation-level guards against remote code execution via Python's pickle module. The included search script (
scripts/library_search.py) explicitly validates file extensions to block the ingestion of potentially malicious serialized data. \n- [SAFE]: External communication is restricted to the establishedmetabolomics-usi.gnps2.orgservice, which is a standard resource for Universal Spectrum Identifiers in the metabolomics community. This network activity is documented as necessary for the skill's primary scientific function. \n- [SAFE]: The skill follows secure dependency management practices by pinning thematchmspackage to a specific, verified version (0.33.1) and using theuvtool for installation. \n- [SAFE]: Although the skill is designed to ingest and process external spectral data formats (MGF, MSP, JSON, and USI), these operations are performed through the standard matchms filtering pipeline. This data ingestion is well-scoped to its scientific purpose and does not exhibit malicious patterns.
Audit Metadata