openfold2-nim

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests user-provided free text in the sequence field and optional A3M alignments.a3m.alignment / mmCIF explicit_templates[].structure by POSTing a JSON payload to the NVIDIA OpenFold2 prediction endpoint (hosted or local), so an outsider can supply poison text directly into the queue/request body the workflow sends/read by the model.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's local Docker startup explicitly pulls and runs the remote container image nvcr.io/nim/openfold/openfold2:latest (and references nvcr.io/nim/openfold/openfold2:2.4.0), which fetches and executes remote code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes explicit local shell commands that create directories, change permissions (mkdir -p, chmod 777), perform docker login, and run a container mounting host paths (with a suggested mount at /opt/nim/.cache), which instructs state-changing operations on the machine even though it doesn't request sudo or create users.