Security audit

PharmaClaw Pharmacology Agent

Security checks across malware telemetry and agentic risk

Overview

The skill matches its advertised pharmacology purpose, but users should know that the ADMETlab helper can send molecule strings to an external service.

Install only if you are comfortable running local Python chemistry tooling. For confidential or proprietary molecules, prefer scripts/chain_entry.py because it performs local RDKit-based profiling; run scripts/admetlab3.py only when sending the provided SMILES to the external ADMETlab service is acceptable. Treat the pharmacology and toxicity outputs as screening estimates, not clinical or regulatory conclusions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation indicates network-capable behavior via ADMETlab 3.0 integration, but no corresponding permission declaration is present. This creates a transparency and governance gap: molecular inputs may be transmitted off-platform without explicit authorization, making review, consent, and policy enforcement harder.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior exceeds the declared purpose by sending data to an external API and producing broader toxicity/ADME outputs than users would expect from the manifest. This is dangerous because users and downstream systems may route sensitive molecular structures under incorrect assumptions about scope, privacy, and regulatory posture.

Context-Inappropriate Capability

Low

Confidence: 91% confidence
Finding: The skill’s hardcoded recommendation to follow on with "ip-expansion" is not supported by the stated pharmacology/ADME profiling purpose and can steer users into an unrelated capability. In an agent ecosystem, this kind of unjustified cross-skill routing can become a trust and data-governance issue, especially if downstream skills handle sensitive project or proprietary compound information.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger terms are broad enough to match ordinary scientific discussion, increasing the chance of accidental invocation. In this skill's context, accidental invocation is more concerning because it may initiate pharmacology profiling and possible network submission of user-provided molecular data without clear intent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill references ADMETlab 3.0 integration but does not clearly warn that submitted molecular structures may be sent to a third-party service. In drug-discovery contexts, SMILES can be proprietary or commercially sensitive, so undisclosed remote transmission creates confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The quick-start examples encourage direct execution but omit any warning that profiling may perform outbound network requests. Users following these examples may unintentionally disclose sensitive candidate structures to a third party, which is especially risky in pharmaceutical R&D settings.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script transmits user-provided SMILES to a third-party service without any explicit user consent flow, warning, or local-only mode default. In this skill context, molecular structures may be proprietary research data, so silent external submission can leak confidential compound information to an external operator and over the network.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.