Pharmaclaw Alphafold Agent
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill does not show credential theft or exfiltration, but it needs Review because it advertises real structure prediction and docking while the included code returns mock or fixed scientific outputs that may be passed to downstream agents.
Install only if you understand this appears to be a prototype: run it in a controlled workspace, pin and review dependencies, avoid proprietary targets in public queries, and do not rely on the mock prediction/docking outputs without independent validation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user or downstream agent could treat placeholder structures, binding sites, or affinity values as real scientific results.
SKILL.md presents the skill as performing ESMFold prediction, binding-pocket detection, and docking, but the code shows placeholder/fixed outputs and a mock affinity calculation.
'''ESMFold mock (HF transformers heavy; prod docker).''' ... sites.append({'res': 'G12', 'pocket_vol': 150}) ... score = -Descriptors.MolWt(ligand) * 0.05 # Mock affinityClearly label the skill as a demo/mock, or replace the placeholder code with validated ESMFold, pocket-detection, and docking workflows before using outputs for research decisions.
Incorrect placeholder results could propagate into later design or IP-analysis steps.
The skill is intended to pass its outputs to downstream agents, but the implementation can produce mock/fixed outputs without a documented validation or containment step.
Feeds into: IP Expansion (novel binding modes), Catalyst Design (structure-guided synthesis)
Require explicit human review and validation before passing this skill's outputs to downstream pipeline agents.
Public services may see queried target identifiers, and output files will be created in the working directory.
The script calls public protein-structure services and writes downloaded PDB files locally, which is expected for the stated retrieval function.
resp = requests.post(self.rcsb_url, json=query) ... f.write(requests.get(pdb_url).text)
Run it in a project workspace and avoid submitting proprietary target information to public services unless that is acceptable.
Users must choose and install dependency versions themselves, which can affect reproducibility and package provenance.
The skill depends on third-party Python packages, but the artifacts provide no pinned versions or install spec.
Dependencies - `rdkit-pypi` - `biopython` - `requests`
Use a reviewed environment or lockfile with pinned package versions before running the script.