Is datasets safe?

No malicious indicators - review capabilities before installing

Notable — review in context (capabilities are not malware):

Python filesystem read
Python filesystem write/delete
Python network egress

datasets-5.0.1 is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: filesystem read, filesystem write and network egress — capabilities are what the code can do, not a verdict on intent. Risk score 10/100 (low).

datasets-5.0.1 5.0.1

python_package · pypi:datasets

LOW

/ 100 risk score

Snapshot · scanned Aug 5, 2026 · datasets-5.0.1@5.0.1 · engine 0.38.1 / ruleset 42

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of datasets's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):

filesystem readfilesystem writenetwork egress

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Filesystem reach

Tool Execution Context

Network egress

Interaction & Communication / Direct Communication

Network exposure

Interaction & Communication

Findings (4)

MEDIUMServer bound to all network interfacesST-EXPOSE-BIND

A server is bound to all network interfaces (0.0.0.0), not just your own machine.

src/datasets/features/mesh.py:282-282

path_without_archive = path.split("::", 1)[0]

Why it matters: Without authentication, other hosts on the network can reach it.

Fix: Bind to 127.0.0.1 for local-only use, or require authentication and restrict access if remote exposure is intended.

MEDIUMPython filesystem readST-FS-PY-READ

The component reads files from disk.

setup.py:249-249

long_description=open("README.md", encoding="utf-8").read(),

src/datasets/arrow_dataset.py:2065-2065

with open(dataset_state_json_path, encoding="utf-8") as state_file:

src/datasets/arrow_dataset.py:2067-2067

with open(dataset_info_path, encoding="utf-8") as dataset_info_file:

src/datasets/arrow_dataset.py:6911-6911

legacy_dataset_info: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8")).get(

src/datasets/arrow_dataset.py:6920-6920

dataset_card = DatasetCard(fs.read_text(config.REPOCARD_FILENAME, newline="", encoding="utf-8"))

src/datasets/arrow_dataset.py:7019-7019

legacy_dataset_infos: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8"))

src/datasets/features/features.py:1186-1186

with open(names_filepath, encoding="utf-8") as f:

src/datasets/filesystems/compression.py:70-70

with self._open_with_fsspec().open() as f:

src/datasets/filesystems/compression.py:85-85

return self._open_with_fsspec().open()

src/datasets/info.py:373-373

with open(os.path.join(dataset_infos_dir, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

src/datasets/load.py:434-434

with open(standalone_yaml_path, encoding="utf-8") as f:

src/datasets/load.py:488-488

with open(os.path.join(self.path, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

src/datasets/load.py:612-612

with open(standalone_yaml_path, encoding="utf-8") as f:

src/datasets/load.py:697-697

with open(dataset_infos_path, encoding="utf-8") as f:

src/datasets/load.py:873-873

dataset_card_data = DatasetCard(hffs.read_text(readme_path, newline="", encoding="utf-8")).data

src/datasets/load.py:877-877

standalone_yaml_data = yaml.safe_load(hffs.read_text(standalone_yaml_path, newline="", encoding="utf-8"))

src/datasets/packaged_modules/arrow/arrow.py:40-40

with open(file, "rb") as f:

src/datasets/packaged_modules/arrow/arrow.py:62-62

with open(file, "rb") as f:

src/datasets/packaged_modules/cache/cache.py:52-52

or json.loads(Path(cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

src/datasets/packaged_modules/cache/cache.py:80-80

or json.loads(Path(_cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

src/datasets/packaged_modules/cache/cache.py:185-185

with open(file, "rb") as f:

src/datasets/packaged_modules/conll/conll.py:126-126

with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

src/datasets/packaged_modules/eval/eval.py:62-62

with open(sample_file) as f:

src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:313-313

with open(metadata_file, "rb") as f:

src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:352-352

with open(metadata_file, "rb") as f:

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMPython filesystem write/deleteST-FS-PY-WRITE

The component writes or deletes files on disk.

src/datasets/arrow_dataset.py:3200-3200

os.remove(file_path)

src/datasets/arrow_dataset.py:4032-4032

os.remove(tmp_file.name)

src/datasets/arrow_dataset.py:4046-4046

shutil.move(tmp_file.name, cache_file_name)

src/datasets/arrow_dataset.py:4601-4601

os.remove(tmp_file.name)

src/datasets/arrow_dataset.py:4606-4606

shutil.move(tmp_file.name, indices_cache_file_name)

src/datasets/builder.py:871-871

shutil.rmtree(dirname)

src/datasets/builder.py:873-873

shutil.move(tmp_dir, dirname)

src/datasets/builder.py:876-876

shutil.rmtree(tmp_dir)

src/datasets/download/download_manager.py:335-335

os.remove(path)

src/datasets/filesystems/__init__.py:50-50

shutil.move(fs._strip_protocol(src), fs._strip_protocol(dst))

src/datasets/fingerprint.py:86-86

shutil.rmtree(self.name)

src/datasets/info.py:344-344

with open(dataset_infos_path, "w", encoding="utf-8") as f:

src/datasets/packaged_modules/cache/cache.py:155-155

shutil.copytree(self.cache_dir, output_dir)

src/datasets/packaged_modules/lance/lance.py:88-88

path.write_bytes(data)

src/datasets/packaged_modules/spark/spark.py:148-148

open(probe_file, "a")

src/datasets/packaged_modules/spark/spark.py:267-267

shutil.move(file, dest)

src/datasets/packaged_modules/webdataset/_tenbin.py:276-276

with open(fname, "wb") as stream:

src/datasets/utils/extract.py:141-141

with open(output_path, "wb") as extracted_file:

src/datasets/utils/extract.py:142-142

shutil.copyfileobj(gzip_file, extracted_file)

src/datasets/utils/extract.py:235-235

with open(output_path, "wb") as extracted_file:

src/datasets/utils/extract.py:236-236

shutil.copyfileobj(compressed_file, extracted_file)

src/datasets/utils/extract.py:301-301

with open(input_path, "rb") as ifh, open(output_path, "wb") as ofh:

src/datasets/utils/extract.py:311-311

with open(output_path, "wb") as extracted_file:

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMPython network egressST-NET-PY

The component makes outbound network requests.

src/datasets/builder.py:26-26

import urllib

src/datasets/builder.py:186-186

str(k) + "=" + urllib.parse.quote_plus(str(v)) for k, v in config_kwargs_to_add_to_suffix.items()

src/datasets/load.py:31-31

import httpx

src/datasets/load.py:32-32

import requests

src/datasets/utils/file_utils.py:26-26

from urllib.parse import urlparse

src/datasets/utils/file_utils.py:30-30

import httpx

src/datasets/utils/file_utils.py:33-33

import requests

src/datasets/utils/file_utils.py:49-49

from aiohttp.client_exceptions import ClientError as _AiohttpClientError

src/datasets/utils/file_utils.py:76-76

return urlparse(url_or_filename).scheme != "" and not os.path.ismount(urlparse(url_or_filename).scheme + ":/")

src/datasets/utils/file_utils.py:83-83

return urlparse(url_or_filename).scheme == "" or os.path.ismount(urlparse(url_or_filename).scheme + ":/")

src/datasets/utils/file_utils.py:87-87

return urlparse(url_or_filename).scheme == "" and not os.path.isabs(url_or_filename)

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →