molmim-nim

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for running a local Docker container (docker run) and checking service readiness via curl. These are standard deployment operations for the NVIDIA NIM microservice architecture and use official NVIDIA container registries (nvcr.io).
  • [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive API keys by instructing the user to set environment variables (NGC_API_KEY, NVIDIA_API_KEY) or use a .env file. It includes a specific warning to 'Do not print keys' and uses docker login with password-stdin to prevent leaking credentials in process lists.
  • [EXTERNAL_DOWNLOADS]: The skill pulls the MolMIM image from the official NVIDIA Container Registry (nvcr.io/nim/nvidia/molmim:1.0.0). This is a well-known, trusted vendor resource required for the skill's primary function.
  • [DATA_EXPOSURE]: The skill interacts with chemical SMILES strings and local model embeddings. Network operations are directed either to localhost for local Docker deployments or to official NVIDIA API endpoints (health.api.nvidia.com). No unauthorized data exfiltration patterns were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 08:21 AM
Security Audit — agent-trust-hub — molmim-nim