Chemistry Query

Chemistry agent skill for PubChem API queries (compound info/properties, structures/SMILES/images, synthesis routes/references) + RDKit cheminformatics (SMIL...

Security Scan

The code and runtime instructions are internally consistent with a PubChem+RDKit chemistry tool; no obvious attempts to exfiltrate credentials or access unrelated systems, but there are a few operational and privacy-related issues to review before running.

Purpose & Capability

Name/description (PubChem queries + RDKit analysis/retrosynthesis) match the included scripts: query_pubchem.py, rdkit_mol.py, admet_predict.py, chembl and PubMed query modules, templates.json of reaction SMARTS, and a Gradio UI. Network calls are limited to public chemistry/data APIs (PubChem, ChEMBL, NCBI) which are expected for the stated purpose.

Instruction Scope

SKILL.md and scripts instruct the agent to run local Python scripts that call external chemistry APIs and perform RDKit processing. The code writes image files under a viz directory, spawns subprocesses to run bundled scripts (e.g., query_pubchem.py), and may create files in the skill directory. Two notable operational items: chem_ui.py contains a hard-coded WORK_DIR path (/home/democritus/..., likely the packager's local path) and launches Gradio with share=True (which will try to create a public link when run). These are not malicious but are privacy/operational concerns and may cause failures or unintended network exposure.

Install Mechanism

There is no install spec and no remote downloads executed automatically. A pyvenv.cfg file is included (indicating a packaged virtualenv metadata entry) but no installer that fetches arbitrary code. scripts/opsin_name_to_smiles.py references opsin.jar and prints a wget URL if missing rather than auto-downloading it. Overall the package does not perform any high-risk remote installs by itself.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. All external access is to public chemical data APIs (PubChem, ChEMBL, NCBI), which matches the skill purpose. No secret-exposing env vars are requested. Note: running the Gradio UI (share=True) will expose a public endpoint if executed, which could leak data you send to the UI.

Persistence & Privilege

always is false and the skill does not request persistent elevated privileges or modify other skills. It writes outputs (images) to a local viz directory inside the skill workspace and invokes local subprocesses; this is normal for a tool of this type. Autonomous invocation is allowed by default but is not combined with other concerning privileges here.

Assessment

What to consider before installing/running: - Functionality and network use: The skill calls PubChem, ChEMBL, and NCBI (PubMed) APIs and runs RDKit locally—this is expected. If you need to avoid external network calls, do not run it or sandbox its network access. - Dependencies: RDKit, Pillow, pandas, gradio, and possibly Java (for OPSIN) are required. The package itself does not install them automatically; install and verify these in a controlled environment. - Gradio exposure: chem_ui.py launches Gradio with share=True and a hard-coded WORK_DIR. If you run the UI, remove or change share=True and adjust WORK_DIR to a safe path. share=True will try to create a public URL and may expose data you input to external services. - Files written: scripts create image files under a viz directory and use a WORK_DIR for the UI. Ensure the skill runs in an isolated workspace so these files don't overwrite or leak host data. - OPSIN: opsin.jar is not bundled; the script prints a wget command if the JAR is missing. The skill does not automatically fetch/execute arbitrary binaries, but if you follow that wget instruction you will download and run third-party Java code—review that separately. - Dual-use / safety: The skill includes retrosynthesis templates and multi-step planning (BRICS/disconnects and named reaction templates). These are legitimate chemistry capabilities but could be sensitive (dual-use). Consider institutional policies and legal/regulatory constraints before performing synthesis planning for hazardous or controlled compounds. - Recommendation: run the skill in a sandboxed environment (container/VM) with limited network access while you verify behavior, remove or change Gradio share=True, check WORK_DIR, and ensure required Python packages are installed from trusted sources.

Chemistry Query Agent v1.4.0

Overview

Full-stack chemistry toolkit combining PubChem data retrieval with RDKit molecule processing, visualization, analysis, retrosynthesis, and synthesis planning. All outputs are structured JSON for easy downstream chaining. Generates PNG/SVG images on demand.

Key capabilities:

• PubChem compound lookup (info, structure, synthesis refs, similarity search)
• RDKit molecular properties (MW, logP, TPSA, HBD/HBA, rotatable bonds, aromatic rings)
• 2D molecule visualization (PNG/SVG)
• BRICS retrosynthesis with recursive depth control
• Multi-step synthesis route planning
• Forward reaction simulation with SMARTS templates
• Morgan fingerprints and similarity/substructure search
• 21 named reaction templates (Suzuki, Heck, Grignard, Wittig, Diels-Alder, etc.)

Quick Start

# PubChem compound info
exec python scripts/query_pubchem.py --compound "aspirin" --type info

# Molecular properties from SMILES
exec python scripts/rdkit_mol.py --smiles "CC(=O)Oc1ccccc1C(=O)O" --action props

# Retrosynthesis
exec python scripts/rdkit_mol.py --target "CC(=O)Oc1ccccc1C(=O)O" --action retro --depth 2

# Full chain (name → props + draw + retro)
exec python scripts/chain_entry.py --input-json '{"name": "caffeine", "context": "user"}'

Scripts

scripts/query_pubchem.py

PubChem REST API queries with automatic name→CID resolution and timeout handling.

--compound <name|CID> --type <info|structure|synthesis|similar> [--format smiles|inchi|image|json] [--threshold 80]

• info: Formula, MW, IUPAC name, InChIKey (JSON)
• structure: SMILES, InChI, image URL, or full JSON
• synthesis: Synonyms/references for a compound
• similar: Similar compounds by 2D fingerprint (top 20)

scripts/rdkit_mol.py

RDKit cheminformatics engine. Resolves names via PubChem automatically.

--smiles <SMILES> --action <props|draw|fingerprint|similarity|substruct|xyz|react|retro|plan>

Action	Description	Key Args
props	MW, logP, TPSA, HBD, HBA, rotB, aromRings	--smiles
draw	2D PNG/SVG (300×300)	--smiles --output file.png --format png|svg
retro	BRICS recursive retrosynthesis	--target <SMILES|name> --depth N
plan	Multi-step retro route	--target <SMILES|name> --steps N
react	Forward reaction via SMARTS	--reactants "smi1 smi2" --smarts "<SMARTS>"
fingerprint	Morgan fingerprint bitvector	--smiles --radius 2
similarity	Tanimoto similarity scoring	--query_smiles --target_smiles "smi1,smi2"
substruct	Substructure matching	--query_smiles --target_smiles "smi1,smi2"
xyz	3D coordinates (MMFF optimized)	--smiles

scripts/chain_entry.py

Standard agent chain interface. Accepts {"smiles": "...", "context": "..."} or {"name": "...", "context": "..."}. Returns unified JSON with props, visualization, and retrosynthesis.

python scripts/chain_entry.py --input-json '{"name": "sotorasib", "context": "user"}'

Output schema:

{
  "agent": "chemistry-query",
  "version": "1.4.0",
  "smiles": "<canonical>",
  "status": "success|error",
  "report": {"props": {...}, "draw": {...}, "retro": {...}},
  "risks": [],
  "viz": ["path/to/image.png"],
  "recommend_next": ["pharmacology", "toxicology"],
  "confidence": 0.95,
  "warnings": [],
  "timestamp": "ISO8601"
}

scripts/templates.json

21 named reaction templates with SMARTS, expected yields, conditions, and references. Includes: Suzuki, Heck, Buchwald-Hartwig, Grignard, Wittig, Diels-Alder, Click, Sonogashira, Negishi, and more.

Chaining

1. Name → Full Profile: chain_entry.py with {"name": "ibuprofen"} → props + draw + retro
2. Chemistry → Pharmacology: Output feeds directly into pharma-pharmacology-agent
3. Retro + Viz: Get precursors, then draw each one
4. Suzuki Test: --action react --reactants "c1ccccc1Br c1ccccc1B(O)O" --smarts "[c:1][Br:2].[c:3][B]([c:4])(O)O>>[c:1][c:3]"

Tested With

All features verified end-to-end with RDKit 2024.03+:

Molecule	SMILES	Tests Passed
Caffeine	CN1C=NC2=C1C(=O)N(C(=O)N2C)C	info, structure, props, draw, retro, plan, chain
Aspirin	CC(=O)Oc1ccccc1C(=O)O	info, structure, props, draw, retro, plan, chain
Sotorasib	PubChem name lookup	info, structure, props, draw, retro, chain
Ibuprofen	PubChem name lookup	info, structure, props, chain
Invalid SMILES	XXXINVALID	Graceful JSON error
Empty input	{}	Graceful JSON error

Resources

• references/api_endpoints.md — PubChem API endpoint reference and rate limits
• scripts/rdkit_reaction.py — Legacy reaction module
• scripts/chembl_query.py, scripts/pubmed_search.py, scripts/admet_predict.py — Additional query modules

Changelog

v1.4.0 (2026-02-14)

• Fixed PubChem SMILES/InChI endpoint (property/CanonicalSMILES/TXT)
• Fixed chain_entry.py HTML entity corruption
• Fixed brics_retro to handle BRICSDecompose string output correctly
• Added request timeouts (15s) to all PubChem calls
• Graceful error handling for invalid SMILES and empty input
• Updated chain output version and schema
• Comprehensive end-to-end testing

v1.3.0

• RDKit props NoneType fixes, invalid SMILES graceful errors
• React fix: ReactionFromSmarts import
• Name resolution via PubChem for all RDKit actions

v1.2.0

• BRICS retrosynthesis + 21 reaction templates library
• Multi-step synthesis planning