Versioned security assessment

Report ID: SA-DCFA102F

6/30/2026, 6:03:00 AM

torch-geometric security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
torch-geometric
Version
v5
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/torch_geometric
Coverage
7 Files scanned · 3,571 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Low

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many high and critical patterns, but semantic review found they are mostly false positives from Markdown code fences, PyTorch model.eval() calls, and machine learning terminology. No prompt injection, credential exfiltration, malicious command execution, or obfuscated behavior was found. Residual low risk remains because community helper scripts can write user-selected files and examples may download PyG datasets or dependencies.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 3,571 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Low
scripts/create_gnn_template.py:463-468scripts/create_gnn_template.py:500-505scripts/create_gnn_template.py:521-523
Intended Local File Write in Template Generator
The template generator writes a generated Python model file to a user-supplied output path. This is expected functionality, but users should avoid running it with untrusted paths or elevated privileges.
The file write is direct and intentional, and the destination comes from a CLI argument. The risk is low because it is a local developer utility and there is no hidden execution or exfiltration path.
RISK-002 Low
SKILL.md:34-36SKILL.md:668-673scripts/benchmark_model.py:141-183scripts/visualize_graph.py:273-282
Expected Dataset and Dependency Network Access
The skill documents installing PyG wheels and loading public datasets. These actions may use network access when a user chooses to run them, but they are normal for a graph machine learning skill.
The network-related behavior is linked to official documentation, wheel installation, or PyG dataset loaders. I found no credential collection, custom exfiltration endpoint, or suspicious hidden request.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:30-36references/datasets_reference.md:15-18references/transforms_reference.md:9-11
False Positive: Markdown Backticks Flagged as Commands
The external command findings are Markdown code fences and inline package names in documentation. They show install commands and PyG examples, but the skill does not execute them automatically.
The referenced lines are fenced Markdown examples or inline code markers. No interpreter, subprocess call, or shell execution path is present in those locations.
Low
scripts/benchmark_model.py:94-129scripts/create_gnn_template.py:69-72scripts/create_gnn_template.py:389-392SKILL.md:352-353SKILL.md:631-633
False Positive: PyTorch Evaluation Mode Flagged as Dynamic Execution
The eval findings are calls to model.eval(), which switches PyTorch modules into evaluation mode. This is not Python eval() and does not execute dynamic input.
The calls are method invocations on model objects in training and inference examples. There is no use of Python eval() or user-controlled code evaluation.
Low
references/layers_reference.md:374-390references/transforms_reference.md:663-668references/datasets_reference.md:522-531
False Positive: ML Terms Flagged as Weak Cryptography or Reconnaissance
The weak cryptography and reconnaissance findings map to graph learning terms such as GCN, GAT, Diffusion, ComplEx, RotatE, and dataset names. These are model or dataset references, not cryptographic or reconnaissance behavior.
The surrounding context is PyTorch Geometric layer, transform, and dataset documentation. I found no evidence that these terms are used for hashing, crypto, host discovery, or network scanning.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable