skills/tassiovale/claude-code-kit/esm/Gen Agent Trust Hub

esm

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Several reference files (esm-c-api.md, forge-api.md, and workflows.md) include code examples that implement caching and checkpointing using the Python pickle module. Specifically, the EmbeddingCache and CheckpointedBatchProcessor classes use pickle.load() to read data from local files like embeddings_cache.pkl and checkpoint.pkl. This function is insecure because it can execute arbitrary code during deserialization. An attacker who can influence these local files could achieve code execution on the user's system.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the esm package via PyPI and directly from the official Biohub GitHub repository. These sources are associated with the project's maintainers and follow standard development workflows.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 06:23 AM