Pharmaclaw Cheminformatics

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:59 PM UTC
• Version: 1.0.0

Overview

This appears to be a real local cheminformatics toolkit, but it should be reviewed because it can consume substantial compute and write user-directed output files without strong limits.

Review before installing in a shared or automated environment. Use a dedicated output directory, avoid running it on untrusted or very large molecules, set external CPU/memory/time limits, and install reviewed pinned dependency versions. Do not treat its FDA/IP/downstream-agent suggestions as legal or regulatory advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/conformer_gen.py:48

Finding

Unbounded Computational Parameters Permit Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/conformer_gen.py:48-55
• scripts/conformer_gen.py:175-180
• scripts/stereoisomers.py:85-91
• scripts/stereoisomers.py:184-196
• scripts/recap_fragment.py:139-153
• scripts/recap_fragment.py:231-244

Vulnerability Type: Uncontrolled resource consumption
Risk Level: Medium

Vulnerable Code

scripts/conformer_gen.py:48-55:

python

# ETKDG parameters
params = rdDistGeom.ETKDGv3()
params.randomSeed = seed
params.pruneRmsThresh = prune_rms
params.numThreads = 0  # use all cores

# Generate conformers
conf_ids = rdDistGeom.EmbedMultipleConfs(mol, numConfs=num_confs, params=params)

scripts/conformer_gen.py:175-180:

python

parser.add_argument("--num_confs", type=int, default=10, help="Number of conformers")
parser.add_argument("--optimize", choices=["mmff", "uff", "none"], default="mmff")
parser.add_argument("--energy_window", type=float, default=None,
                    help="Energy window in kcal/mol (filter high-energy confs)")
parser.add_argument("--prune_rms", type=float, default=0.5,
                    help="RMSD threshold for pruning similar conformers")

scripts/stereoisomers.py:85-91:

python

# Configure enumeration options
opts = StereoEnumerationOptions()
opts.onlyUnassigned = only_unassigned
opts.maxIsomers = max_isomers
opts.unique = unique

# Enumerate
isomers = list(EnumerateStereoisomers(mol, options=opts))

scripts/stereoisomers.py:184-196:

python

parser.add_argument("--max_isomers", type=int, default=64)
parser.add_argument("--only_unassigned", action="store_true",
                    help="Only enumerate unassigned stereocenters")

args = parser.parse_args()

if args.action == "analyze":
    result = analyze_stereo(args.smiles)
elif args.action == "compare":
    result = compare_enantiomers(args.smiles)
else:
    result = enumerate_stereois
...[truncated 3040 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce strict ranges for every caller-controlled numeric parameter. For example, limit conformers and stereoisomers to a deployment-approved maximum and restrict RECAP depth to a small positive value.
• Reject zero, negative, non-finite, or otherwise nonsensical values.
• Replace params.numThreads = 0 with a small configurable upper bound.
• Limit molecular complexity using atom count, heavy-atom count, rotatable-bond count, ring count, and potential stereocenter count rather than relying only on SMILES length.
• Apply process-level CPU, memory, and wall-clock limits around RDKit operations.
• Avoid eagerly materializing potentially large generators where incremental processing is possible.
• Apply request quotas and concurrency controls when exposing these scripts through an Agent or service interface.
• Return a controlled error when an input exceeds the permitted complexity or resource budget.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:165

Finding

Third-Party Dependencies Are Unpinned and Not Integrity-Verified

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:165-171
Related Locations: RDKit import-error installation prompts in the Python scripts, including scripts/chain_entry.py:25-29
Vulnerability Type: Dependency supply-chain weakness
Risk Level: Low

Vulnerable Code

SKILL.md:165-171:

markdown

## Dependencies

- Python ≥ 3.10
- rdkit-pypi
- Pillow (for pharmacophore map PNG)
- numpy

scripts/chain_entry.py:25-29:

python

try:
    from rdkit import Chem
except ImportError:
    print(json.dumps({"error": "RDKit not installed. pip install rdkit-pypi"}))
    sys.exit(1)

Technical Analysis

The project names its dependencies but does not pin exact versions, provide a lock file, or specify cryptographic hashes. The runtime error message recommends a direct package installation command that resolves the currently available package from the operator's configured Python package index.

This does not prove that any listed dependency is malicious. However, mutable dependency resolution prevents reproducible builds and increases exposure to compromised releases, unsafe package indexes, dependency substitution, or future incompatible versions. Dependencies such as RDKit, Pillow, and NumPy process complex data and include native components, increasing the importance of controlled provenance and timely security updates.

Attack Path

1. An operator deploys the Skill in an environment without RDKit.
2. The script displays the recommendation to run pip install rdkit-pypi.
3. The operator installs the package without a locked version or verified hash.
4. The package manager resolves artifacts from the configured index at installation time.
5. If that index, package release, or dependency chain has been compromised, attacker-controlled installation or runtime code may execute with the privileges of the installing user.

This exploitation path depends on an external su ...[truncated 581 chars]

Remediation

View remediation

Remediation Suggestions

• Provide a dependency lock file containing exact, reviewed versions.
• Use cryptographic hashes for downloaded artifacts, such as pip hash-checking mode.
• Install packages only from an approved and authenticated package repository.
• Build and deploy from a controlled environment rather than asking runtime users to install dependencies interactively.
• Generate and maintain a software bill of materials.
• Integrate dependency vulnerability scanning and automated update review into the release process.
• Pin versions compatibly with the supported Python runtime and test upgrades before release.
• Document the verified package source and installation procedure instead of presenting an unconstrained pip install command.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is much broader than the supplied code. The code only implements molecular format conversion and basic 3D coordinate generation during export to structure formats. It can read SDF/MOL/PDB/MOL2 files or SMILES, convert to SMILES/InChI/InChIKey/MOL/SDF/PDB/XYZ, and batch-process multi-molecule files. However, it does not implement pharmacophore analysis, RECAP fragmentation, stereoisomer enumeration, or general cheminformatics profiling, all of which are central parts of the declared purpose. The primary purpose is therefore materially narrower than advertised. There is no concerning undeclared external access, but the behavior does not accurately represent the broad declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description substantially overstates the code’s scope. The supplied script is specifically a pharmacophore analysis tool with limited supporting 3D embedding. It does match parts of the description related to pharmacophore feature extraction, fingerprints, comparison, and mapping, and it does generate a 3D conformer internally for feature positioning. However, the declared purpose presents a much broader 'advanced cheminformatics agent' covering format conversion, RECAP fragmentation, stereoisomer enumeration, library design support, docking prep, and integration chaining, none of which appear in the code. This is a material description-versus-behavior mismatch because the primary declared capability set is far broader than the actual implemented behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description substantially overstates the skill's scope. The supplied code only supports one subset of the declared functionality: stereoisomer analysis/enumeration from SMILES, plus limited descriptor reporting. It does not perform 3D molecular analysis, conformer generation, force-field optimization, pharmacophore mapping, file format conversion, RECAP fragmentation, or workflow chaining. While stereoisomer enumeration is accurately represented, the overall declared purpose does not accurately describe what this specific code chunk actually does, making this a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises scripts that write output files such as SDF, PDB, PNG, and arbitrary output paths, but the manifest declares no explicit tool scope or permission boundaries. In an agent framework, undocumented file-write capability increases the chance of unauthorized filesystem modification, path misuse, or unsafe chaining because the platform cannot constrain what the skill is allowed to write.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list is very broad, including generic chemistry and workflow terms such as 'format conversion,' 'fragmentation,' 'library design,' and 'docking prep,' which can cause the skill to activate on ordinary requests outside its safest intended scope. Over-triggering is risky in an agent ecosystem because it can route sensitive or unrelated tasks into a file-writing chemistry skill and amplify the effect of inaccurate outputs or unsafe side effects.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/chain_entry.py (reported line 35)May include surrounding context.

python

def run_module(module_name: str, func_name: str, **kwargs):
    """Dynamically import and run a module function."""
    try:
        mod = __import__(module_name)
        func = getattr(mod, func_name)
        return func(**kwargs)
    except Exception as e:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes this skill as performing cheminformatics operations such as conformer generation, pharmacophore mapping, format conversion, RECAP fragmentation, stereoisomer enumeration, and profiling. The code goes further by emitting normative drug-development/regulatory advice ("FDA requirement") and recommending downstream patent-expansion and catalyst-design agents, which are business/workflow decisions rather than core cheminformatics analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Recommending "ip-expansion" based on the presence of stereoisomers introduces an intellectual-property strategy capability. That is not an obvious or necessary part of performing molecular analysis, pharmacophore extraction, format conversion, fragmentation, or stereoisomer enumeration as described in the manifest.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/chain_entry.py (reported line 36)May include surrounding context.

python

"""Dynamically import and run a module function."""
    try:
        mod = __import__(module_name)
        func = getattr(mod, func_name)
        return func(**kwargs)
    except Exception as e:
        return {"error": f"{module_name}.{func_name} failed: {str(e)}"}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code writes conformer data to a user-specified output file when --output is provided, but there is no confirmation prompt or visible runtime message indicating that a file will be created or overwritten. Although the CLI help mentions an output file path, the execution path itself provides no user-facing disclosure around the write operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code writes converted molecular data to a user-specified path, but provides no explicit user-facing warning, confirmation prompt, or log message at the point of write. Although the CLI exposes an --output parameter and the module docstring shows examples, the code itself does not clearly disclose that existing files may be created or overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The SDF writer persists data to disk when an output path is supplied, but there is no explicit warning, confirmation, or user-facing log around this write. The action affects local files and should be disclosed more clearly to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

In batch mode, the script writes multiple molecules to a single SDF file, but there is no user-facing disclosure at the time of the write and no warning about potential overwrite of the destination. This is a safety-relevant file modification operation under the code-file criteria.

Content

No source excerpt is available for this finding.