nvmolkit-usage

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references installation of the nvmolkit package from PyPI and conda-forge, and redirects users to the official PyTorch website (pytorch.org) for specific CUDA backend selection. It also links to documentation hosted on nvidia-bionemo.github.io. These resources are consistent with the vendor author and well-known services.
  • [COMMAND_EXECUTION]: The skill provides standard package management commands for conda, pip, and uv to set up the runtime environment. These commands are necessary for the skill's intended purpose and do not exhibit malicious patterns.
  • [INDIRECT_PROMPT_INJECTION]: Several recipes include code that reads SMILES strings from local files (e.g., input.smi). This creates an ingestion surface for external data, but the skill uses this data exclusively for cheminformatics operations (fingerprinting, embedding, clustering) without high-privilege side effects.
  • [DATA_EXPOSURE]: Code examples demonstrate reading molecule data from local files and outputting results to JSON. This behavior is standard for scientific computing tools and does not involve accessing sensitive system credentials or private files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 08:49 AM
Security Audit — agent-trust-hub — nvmolkit-usage