molfeat
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the use of
MoleculeTransformer.from_state_yaml_fileandModelStore.load(usingjoblib). These functions involve deserializing configuration or model weights, which can execute arbitrary code if the input file is malicious. The skill provides clear guidance to only load trusted artifacts and highlights the risks of arbitrary third-party state. - [REMOTE_CODE_EXECUTION]: The documentation mentions the
MolJEPATransformeradapter, which requires enabling the 'trust-remote-code' flag for specific Hugging Face models. This is a known security-sensitive feature of thetransformerslibrary used to execute model-specific code provided by authors. - [EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fetch model metadata from
https://fs.molfeat.datamol.io/artifacts/and model weights from the Hugging Face Hub. These are well-known, domain-specific services essential for the skill's primary functionality.
Audit Metadata