Pharmaclaw Pharmacology Agent

• Risk level: Low
• Analyzed: May 1, 2026, 5:47 AM
• Findings: 1
• Version: 1.1.0

Overview

The artifacts consistently implement a local SMILES-to-ADME profiling helper with no evidence of credential access, persistence, data exfiltration, or destructive behavior.

This skill appears safe to install from the provided artifacts. Before use, make sure the local Python/RDKit environment is trusted, and treat the ADME/PK outputs as heuristic scientific predictions rather than definitive clinical or regulatory conclusions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI05: Unexpected Code Execution

Note

What this means

Using the skill may execute local Python code, though the provided script only parses molecule input and computes local RDKit-based results.

Why it was flagged

The skill's normal use involves running a bundled local Python script. This is disclosed and purpose-aligned for computing pharmacology descriptors, but it still means the user is trusting local code and its Python/RDKit dependencies.

Skill content

exec python scripts/chain_entry.py --input-json '{"smiles": "CC(=O)Oc1ccccc1C(=O)O", "context": "user"}'

Recommendation

Install and run it only in an environment where the bundled script and RDKit dependency are trusted; keep execution tied to user-provided molecule inputs.