nmr-prediction
Warn
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
joblib.load()andtorch.load()to process model weights and scaling parameters downloaded from Zenodo. These methods are based on Python'spicklemodule and can execute arbitrary code contained within the files. Affected files includeassets/NMRNet/uninmr/utils/data_scaler.pyandassets/Uni-Core/unicore/checkpoint_utils.py. - [REMOTE_CODE_EXECUTION]: The Uni-Core framework uses
eval()andexec()to parse configuration strings, such asadam-betasand other list/dictionary arguments. This occurs inassets/Uni-Core/unicore/utils.pyandassets/Uni-Core/unicore/optim/adam.py. - [EXTERNAL_DOWNLOADS]: Fetches approximately 1.1GB of model data from Zenodo (
zenodo.org), which is a well-known scientific data repository. - [COMMAND_EXECUTION]: The installation script
assets/Uni-Core/setup.pyexecutessubprocess.check_outputto query the system's CUDA environment.
Audit Metadata