Skills matchms

📦

matchms

Name: matchms
Author: davila7

Content revision r2 High Risk ⚡ Contains scripts📁 Filesystem access⚙️ External commands

Analyze Mass Spectra with Matchms

Mass spectrometry workflows require careful format handling, metadata cleanup, and consistent scoring. This skill guides matchms imports, filtering, similarity analysis, and reproducible pipelines.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "matchms" from https://skillstore.io/skills/davila7-matchms.md and its manifest at https://skillstore.io/api/skills/davila7-matchms/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-matchms.md Signed manifest GET /api/skills/davila7-matchms/manifest Signed lockfile GET /api/skills/davila7-matchms/lockfile

Test it

Using "matchms". Clean an MGF dataset containing noisy spectra and incomplete metadata.

Expected outcome:

Plan: harmonize metadata, require precursor m/z, normalize intensities, remove precursor-adjacent peaks, and reject spectra below the peak threshold.
Result summary: report loaded, retained, rejected, and exported spectrum counts with all filter parameters.

Using "matchms". Compare unknown spectra with a reference library using two similarity metrics.

Expected outcome:

The workflow applies identical preprocessing to both collections before scoring.
Each query receives ranked candidates with cosine score, modified cosine score, matched peaks, precursor m/z, and reference metadata.

Using "matchms". Choose a format for sharing processed spectra with collaborators.

Expected outcome:

Use MGF for broad compatibility and readable exchange. Use JSON when structured GNPS-compatible data is required, and avoid pickle for untrusted exchange.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

All 49 static findings were reviewed and dismissed as scanner false positives from Python imports, scientific terminology, local file examples, or Markdown backticks. No shell execution, dynamic import, or reconnaissance behavior appears at the cited locations. However, the documentation recommends pickle loading without warning that untrusted pickle files can execute arbitrary code.

Files scanned

1,933

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

references/importing_exporting.md:138-154

Unsafe Pickle Deserialization Guidance

The skill recommends load_from_pickle without warning that Python pickle may execute code during deserialization. Untrusted pickle files can cause arbitrary code execution.

The cited example directly loads a pickle file and presents it as a normal import path. The documented disadvantages omit trust and code-execution risks.

Risk Factors

⚡ Contains scripts (10)

references/filtering.md:237-239 references/filtering.md:249-250 references/filtering.md:262-263 references/filtering.md:273-274 references/workflows.md:75-78 references/workflows.md:128-129 references/workflows.md:131-132 references/workflows.md:263-267 references/workflows.md:386-389 references/workflows.md:502-503

📁 Filesystem access (2)

references/importing_exporting.md:344 references/importing_exporting.md:323

⚙️ External commands (25)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-matchms/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-matchms/security.svg)](https://skillstore.io/skills/davila7-matchms?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-matchms?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-matchms/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-matchms.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). matchms security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-matchms/audits/9

BibTeX citation

@techreport{davila7-davila7-matchms-2026,
  author = {davila7},
  title = {matchms security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-matchms/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "matchms security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-matchms/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-matchms:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

K-Dense-AI Recommended

k-dense-ai-matchms

Skillstore Score 73

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

davila7 Current

davila7-matchms

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Clean Metabolomics Spectra

Standardize metadata, normalize peaks, apply quality thresholds, and export a consistent dataset for downstream analysis.

Build Spectral Library Searches

Preprocess queries and references consistently, calculate similarity scores, and rank candidate compound matches.

Create Reproducible Pipelines

Define reusable filters, format conversions, scoring parameters, and reports for repeated datasets.

Try These Prompts

Inspect a Spectrum File

Load [input file] with matchms. Summarize detected spectra, key metadata fields, missing values, and the safest next preprocessing steps.

Clean a Dataset

Create a matchms preprocessing workflow for [format] data. Harmonize metadata, normalize intensities, remove precursor peaks, enforce [minimum peaks], and retain valid spectra.

Match a Spectral Library

Design a library-matching workflow for [queries] against [reference library]. Compare CosineGreedy and ModifiedCosine using [tolerance], then rank the top [count] matches.

Scale a Reproducible Pipeline

Build a memory-conscious matchms pipeline for [dataset size]. Combine precursor filtering, spectral similarity, optional fingerprints, checkpoints, and reproducible parameter reporting. Avoid untrusted pickle inputs.

Best Practices

Apply identical preprocessing to query and reference spectra before calculating similarity.
Record filter order, thresholds, tolerances, package versions, and input formats for reproducibility.
Use generators for large files and load pickle data only from trusted sources.

Avoid

Do not compare raw queries against differently processed references.
Do not treat a high similarity score as confirmed compound identification without metadata and experimental validation.
Do not load pickle files from unknown or unverified sources.