earth2studio-create-diagnostic

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Security
SecurityMEDIUM
references/method-templates.py

This module is an ML inference wrapper that loads a remotely sourced model package and performs inference. The main supply-chain security weakness is the use of `torch.load(..., weights_only=False)` on an externally obtained `model.pt`, which can enable arbitrary code execution during deserialization if the artifact is malicious or tampered with. Other logic is largely standard (coordinate handling, normalization, and tensor arithmetic) with no obvious exfiltration or persistence mechanisms visible. Mitigate by strongly verifying/pinning artifact integrity and using safer loading constraints (e.g., weights-only/safe serialization) where compatible.

Confidence: 68%Severity: 72%
Audit Metadata
Analyzed At
Jul 22, 2026, 08:02 AM
Package URL
pkg:socket/skills-sh/NVIDIA%2Fearth2studio%2Fearth2studio-create-diagnostic%2F@ef941d31c8dfd166b36bb090326b97aeca194f2fa22c2358121efb76e9506643
Security Audit — socket — earth2studio-create-diagnostic