ClawHub
Back to skill

Security audit

Pharmaclaw Alphafold Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is framed as a drug-discovery AlphaFold and docking agent, but the implementation uses mock scientific outputs while presenting them as usable structure, pocket, and docking results.

Review this carefully before installing. It may be acceptable only as a demo scaffold, not as a source of scientific evidence. Do not use its reported structures, binding sites, or docking affinities for drug-discovery decisions unless the mock paths are replaced with validated implementations and outputs are clearly labeled with provenance. Run it only in a controlled working directory because it writes predictable output files and performs external HTTP requests.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/alphafold_agent.py:38
Finding

Predictable Output Files Permit Local File Overwrite Through Symbolic Links

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/alphafold_agent.py:32
Finding

Unbounded External HTTP Requests Can Cause Resource Exhaustion and Indefinite Blocking

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/alphafold_agent.py:43
Finding

Unvalidated FASTA and SMILES Inputs Permit Crashes and Computational Resource Exhaustion

Content
View full analysis
str: '''ESMFold mock (HF transformers heavy; prod docker).''' seq = [s for s in parse(fasta, 'fasta')][0].seq ``` ```python def dock_ligand(self, pdb: str, smiles: str) -> Dict: '''RDKit conformer mock dock.''' ligand = Chem.MolFromSmiles(smiles) AllChem.EmbedMolecule(ligand) score = -Descriptors.MolWt(ligand) * 0.05 # Mock affinity ``` ```python def execute(self, query: Dict) -> Dict: fasta = query.get('fasta', '') uniprot = query.get('uniprot', 'P01116') # KRAS ex smiles = query.get('smiles', '') pdb = self.fetch_public_pdb(uniprot) or self.predict_esmfold(fasta) sites = self.binding_sites(pdb) docking = self.dock_ligand(pdb, smiles) if smiles else None ``` ### Technical Analysis The FASTA path and SMILES string are accepted without schema, type, size, or complexity validation. The FASTA parser is fully materialized into a list before the first sequence is selected. A large file or a file containing many records can therefore consume excessive memory. An empty or malformed FASTA file causes indexing or parsing errors. The fallback can also call `predict_esmfold()` with an empty path when no structure is found and no FASTA input was supplied. `Chem.MolFromSmiles()` can return `None` for an invalid SMILES string, but the result is passed directly to `AllChem.EmbedMolecule()` and descriptor processing. Complex molecular inputs can also impose significant CPU or memory costs during parsing and conformer embedding. The script does not catch these failures, so malformed or expensive input can terminate or stall the entire process. ### Attack Path 1. An untrusted caller submits a query wi ...[truncated 1113 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior materially overstates what the skill actually does, including mocked structure prediction, fake binding-site detection, and non-docking presented as docking. In a drug-discovery workflow, this can mislead downstream agents or users into treating placeholder outputs as scientifically valid, causing unsafe decisions, wasted resources, or bad experimental prioritization.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The module description and workflow overstate core capabilities that are actually mocked. Because this skill is positioned for protein structure and docking tasks, the mismatch is especially dangerous: users may trust it for scientific inference when it cannot perform the claimed analyses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The function claims to perform ESMFold prediction but instead writes a hard-coded mock PDB. In a scientific or drug-design workflow, this can mislead downstream users and agents into making decisions based on fabricated structural data, creating integrity and safety risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code advertises binding-site detection but returns a fixed pocket regardless of input structure. This is dangerous because it can produce false scientific conclusions and contaminate downstream prioritization, docking, or medicinal chemistry decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docking routine does not dock against the protein at all; it derives a fake affinity from ligand molecular weight and saves only a ligand image. In this domain, presenting such output as docking results is materially misleading and may drive invalid compound selection or experimental follow-up.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises capabilities that require network access and file writing but does not declare an explicit tool scope or permission boundary. That makes the runtime trust model ambiguous and can lead to over-privileged execution, especially in agent platforms where undeclared capabilities may be inherited or loosely enforced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list includes broad terms like structure, target, binding site, and fold, which can cause the skill to activate in unrelated conversations. Unintended invocation is risky here because the skill has network and file-writing behavior and may inject misleading scientific outputs into contexts that did not request this specialized analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alphafold_agent.py (reported line 34)May include surrounding context.

python
},
            "return_type": "polymer_entity"
        }
        resp = requests.post(self.rcsb_url, json=query)
        if resp.ok:
            hits = resp.json()['result_set']
            if hits:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The method sends an HTTP request to RCSB and then downloads a PDB file and writes it to the local filesystem, but there is no confirmation prompt, user-facing log, or warning in this file indicating that network access and file creation will occur. Because these operations may affect privacy, connectivity expectations, or local files, they should be disclosed to the user.

Content

No source excerpt is available for this finding.

Tainted flow: 'pdb_id' from requests.post (line 38, network input) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/alphafold_agent.py (reported line 40)May include surrounding context.

python
if hits:
                pdb_id = hits[0]['rcsb_id'][:4].lower()
                pdb_url = f'https://files.rcsb.org/download/{pdb_id}.pdb'
                with open(f'{pdb_id}.pdb', 'w') as f:
                    f.write(requests.get(pdb_url).text)
                return f'{pdb_id}.pdb'
        return None

Tainted flow: 'pdb_url' from requests.post (line 39, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/alphafold_agent.py (reported line 41)May include surrounding context.

python
pdb_id = hits[0]['rcsb_id'][:4].lower()
                pdb_url = f'https://files.rcsb.org/download/{pdb_id}.pdb'
                with open(f'{pdb_id}.pdb', 'w') as f:
                    f.write(requests.get(pdb_url).text)
                return f'{pdb_id}.pdb'
        return None

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code writes an esm_fold.pdb file to disk as part of fallback prediction, but there is no visible disclosure, prompt, or warning that a local file will be created. Even though file output may be part of the workflow, this file itself does not communicate that side effect to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The docking routine saves docked.png to the current directory, but the code provides no user-facing notice that an output image file will be created. This is a filesystem side effect that should be made explicit.

Content

No source excerpt is available for this finding.