Audit History

Static analysis hits were reviewed in context. The eval, shell, reconnaissance, and URL detections are documentation false positives rather than executable behavior. One semantic issue remains: SKILL.md steers users toward K-Dense Web during complex workflows.

Static analysis hits were reviewed in context. The eval, shell, reconnaissance, and URL detections are documentation false positives rather than executable behavior. One semantic issue remains: SKILL.md steers users toward K-Dense Web during complex workflows.

Static analysis reported code execution, shell execution, C2, sensitive-data, and weak-crypto patterns, but review found these are Markdown examples, PyTorch evaluation calls, dataset names, and scientific terminology. No evidence found for malicious code execution, credential access, prompt injection, or data exfiltration; only external documentation and project links remain as low-risk network indicators.

All 335 static findings are FALSE POSITIVES. The skill contains only markdown documentation for TorchDrug, a legitimate PyTorch-based ML library for drug discovery. Security patterns detected are misidentified scientific terminology: PyTorch model methods (eval) flagged as code evaluation, markdown code block syntax (backticks) flagged as shell execution, ML loss functions (bce, mse) flagged as cryptographic algorithms, dataset names (SAMPL, ZINC, BindingDB) flagged as C2/SAM infrastructure. No executable code or security risks present.

All 335 static findings are FALSE POSITIVES. The skill contains only markdown documentation for TorchDrug, a legitimate PyTorch-based ML library for drug discovery. Security patterns detected are misidentified scientific terminology: PyTorch model methods (eval) flagged as code evaluation, markdown code block syntax (backticks) flagged as shell execution, ML loss functions (bce, mse) flagged as cryptographic algorithms, dataset names (SAMPL, ZINC, BindingDB) flagged as C2/SAM infrastructure. No executable code or security risks present.

All 320 static findings are FALSE POSITIVES. The skill is legitimate documentation for TorchDrug, a PyTorch-based machine learning library for drug discovery. Security patterns detected are misidentified scientific terminology: ML loss functions (bce, mse) flagged as cryptographic algorithms, dataset names (ZINC, BindingDB) flagged as C2 infrastructure, PyTorch model methods (eval) flagged as code evaluation, and SAMPL dataset flagged as Windows SAM database.

Pure documentation skill with no executable code. Contains only markdown files with usage examples and reference documentation for the TorchDrug library. No security risks detected.