ClawHub
Back to skill

Security audit

Pharmaclaw Ip Expansion Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly consistent with a pharma IP analysis tool, but it can automatically send sensitive molecule and patent-strategy data to external services and persist results locally without clear user control.

Review before installing in any confidential or regulated pharma environment. Use only with data you are allowed to send to PatentsView and PubChem, isolate the Python environment, pin and verify dependencies, and require explicit approval before network lookups, report writes, database updates, logging, or scheduled portfolio checks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:82
Finding

Installation Instructions Include an Unnecessary and Untrusted PyPI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:82
Vulnerability Type: Supply-chain exposure through an unnecessary and unpinned dependency
Risk Level: Medium

Vulnerable Code:

text
- Deps: `pip install rdkit-pypi requests pandas sqlite3 spacy scispacy` (assume chemistry env).

Technical Analysis

The documented installation command instructs users to install multiple dependencies without pinned versions or cryptographic hashes. It also instructs users to install sqlite3 from PyPI even though sqlite3 is included in Python's standard library and does not need to be installed separately.

Installing an unnecessary package with the name of a standard-library module creates avoidable supply-chain exposure. If the referenced PyPI distribution is malicious, compromised, or later replaced, its build or installation process could execute attacker-controlled code. The absence of exact versions and hashes also permits dependency contents to change after this skill has been audited.

The command is documentation rather than an automatically executed code path, so exploitation requires a user or automation process to follow the installation instructions.

Attack Path

  1. A user prepares the environment by following the dependency command in SKILL.md.
  2. pip resolves the unpinned sqlite3 distribution or another compromised dependency from the configured package index.
  3. The package supplies malicious build-system, installation, or imported runtime code.
  4. The malicious code executes with the privileges of the user or service account running pip.
  5. The attacker may access files, credentials, network resources, and agent data available to that account.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the environment performing the installation. The scope may include the project's files, the user's home directory, accessible API crede ...[truncated 185 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove sqlite3 from the installation command because it is part of Python's standard library.
  • Define dependencies in a lock file or requirements file with exact versions.
  • Require cryptographic hashes, such as through pip install --require-hashes.
  • Review and approve all direct and transitive dependencies before deployment.
  • Install dependencies inside an isolated virtual environment using a trusted package index.
  • Add automated dependency vulnerability and provenance checks to the release process.

T08 · Insecure Dependencies

Warning
Location
scripts/agent.py:21
Finding

Runtime Guidance Installs an Unverified Package Artifact from a Remote URL

Content
View full analysis

Vulnerability Details

File Location: scripts/agent.py:21-24
Vulnerability Type: Unpinned remote package installation guidance without integrity verification
Risk Level: Medium

Vulnerable Code:

python
except ImportError:
    print("Install: pip install scispacy[scispacy_models] https://s3-us-west-2.amazonaws.com/ai2-s2-scispacy/releases/v0.5.1/en_core_sci_sm-0.5.1.tar.gz")
    sys.exit(1)

Technical Analysis

When the NLP imports fail, the program prints a command that installs scispacy without a pinned version and installs a Python model directly from a remote archive URL. The command provides no expected digest, signature, or other integrity check.

Python source archives can contain build metadata and installation logic that execute code during package installation. If the remote object, its hosting account, the distribution path, or the user's network trust configuration is compromised, following this command could install and execute modified code. The unpinned scispacy dependency can also resolve to a different release after the audit.

The application does not execute the displayed command automatically. Exploitation therefore depends on a user or deployment automation copying and running the recommended command.

Attack Path

  1. The application starts in an environment where spacy, scispacy, or the requested module is unavailable.
  2. The ImportError handler displays the installation command.
  3. A user or provisioning script executes that command to satisfy the dependency.
  4. pip downloads the unpinned dependency and remote source archive without validating an audit-approved hash or signature.
  5. A compromised artifact executes attacker-controlled build or installation code under the installing account.
  6. The attacker can then modify the environment, access readable data, or persist malicious behavior through the installed package.

Impact Assessment

Successf ...[truncated 423 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the printed ad hoc command with a reference to a reviewed, version-controlled dependency lock file.
  • Pin scispacy and all transitive dependencies to exact versions.
  • Pin the model archive by an approved SHA-256 hash and verify it before installation.
  • Prefer a signed or otherwise provenance-verified official distribution from a trusted package repository.
  • Avoid encouraging direct installation from mutable URLs.
  • Install dependencies in a non-privileged isolated environment.
  • Fail with a concise dependency error rather than presenting an unverified command for users to execute.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises capabilities that include network access and file writes, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that mismatch can cause the skill to be invoked with broader-than-expected authority, enabling unintended external requests, report writes, database modification, and logging without clear user consent or runtime restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger language is very broad, covering many generic IP, novelty, molecule, and portfolio-related terms, plus automatic chaining from other agents. That increases the chance of unintended invocation on sensitive chemistry or legal-analysis inputs, which is risky because the skill performs external API queries, writes reports, and may initiate downstream actions based on loosely matched context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description does not adequately warn users that it writes reports, logs activity, queries or updates a SQLite portfolio database, and mentions autonomous cron-based checks. Hidden or under-disclosed state changes are dangerous because users may expose confidential molecular IP data or unintentionally alter local state without understanding retention, logging, or scheduling behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apis.md (reported line 4)May include surrounding context.

md
# Patent/Compound APIs

## USPTO PatentsView (free JSON)
- Query: POST https://api.patentsview.org/patents/query
- Ex: {'q': {'_text_any': ['aspirin']}, 'f': ['patent_number']}
- Full: https://developer.uspto.gov/api-catalog

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The agent initializes a persistent local SQLite database and later writes reports/logs to disk, creating durable storage of potentially sensitive patent, claims, SMILES, and therapeutic data. In a multi-tenant or shared execution environment, undisclosed persistence can expose confidential R&D and IP information beyond the user's expected analytical workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The docstring and function shape imply a working portfolio-monitoring feature, but track_portfolio builds [dict(row) for row in cur.fetchall()] even though the SQLite connection is created without a row_factory. In practice this contradicts the documented intent because fetched rows are ordinary tuples, so the advertised monitoring behavior will fail rather than return portfolio records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The method is documented as searching USPTO/PubChem for blocking freedom-to-operate results, which implies meaningful chemical similarity analysis. However, the PubChem request is built from the therapeutic string in a fast similarity endpoint that expects a compound identifier or structure-derived input, so the implementation does not match the stated analysis intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The hard-coded third-party endpoint indicates built-in exfiltration of analysis inputs to an external service as part of normal operation. In this skill's context, even legitimate patent searching becomes security-relevant because users may supply proprietary molecule and FTO data whose disclosure could materially harm patentability, secrecy, or competitive position.

Content

Scanner excerpt · scripts/agent.py (reported line 95)May include surrounding context.

python
def fto_assess(self, therapeutic: str, keywords: List[str]) -> Dict:
        """FTO: Search USPTO/PubChem for blocking."""
        # USPTO PatentsView
        url = 'https://api.patentsview.org/patents/query'
        q = {'q': {'_and': [{'text': {'_any': keywords}}, {'text': therapeutic}]}, 'f': ['patent_number', 'patent_title', 'filing_date']}
        resp = requests.post(url, json=q).json()
        patents = resp.get('patents', [])

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends user-supplied therapeutic and keyword data to third-party services (patentsview and pubchem) without consent, redaction, or disclosure. In this context, the inputs may contain highly sensitive pre-public drug discovery, FTO, or portfolio strategy information, so external transmission can leak valuable trade secrets and reveal legal strategy.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This code performs an external POST request containing user-controlled therapeutic and keyword data to a third-party patent API. For a pharmaceutical IP-analysis agent, those fields can encode non-public compounds, indications, and strategy terms, making outbound transmission especially dangerous because it can disclose commercially sensitive R&D and legal positioning.

Content

Scanner excerpt · scripts/agent.py (reported line 97)May include surrounding context.

python
# USPTO PatentsView
        url = 'https://api.patentsview.org/patents/query'
        q = {'q': {'_and': [{'text': {'_any': keywords}}, {'text': therapeutic}]}, 'f': ['patent_number', 'patent_title', 'filing_date']}
        resp = requests.post(url, json=q).json()
        patents = resp.get('patents', [])
        blockers = [p for p in patents if self._is_blocking(p)]
        # PubChem similar actives

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The agent loads the specific model "en_core_sci_sm", which enforces English-language processing behavior. There is no nearby natural-language documentation or option allowing users to choose another language or opt into this locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.