ml-property-predictor

Warn

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to manage training and evaluation tasks across isolated Conda environments, specifically seen in examples/mace_bulk_modulus/run_mace.py and examples/matgl_bulk_modulus/run_matgl.py.
  • [COMMAND_EXECUTION]: In scripts/train_mace_property.py, the skill implements a dynamic code execution pattern where it writes a temporary Python wrapper script to the filesystem and then executes it using sys.executable. This mechanism is used to patch the mace.cli.run_train module to freeze the model backbone.
  • [EXTERNAL_DOWNLOADS]: The scripts/train_matgl_property.py script performs network operations to download pre-trained weights from the MatGL model registry. These downloads originate from well-known scientific sources but represent external binary artifacts.
  • [COMMAND_EXECUTION]: scripts/train_mace_property.py includes a hardcoded absolute fallback path to a developer's local home directory (/home/bdeng/...) to locate necessary patch scripts, indicating environment-specific dependencies that may lead to execution failures on different systems.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 19, 2026, 04:47 PM