ClawHub
Back to skill

Security audit

PharmaClaw Pharmacology Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs pharmacology profiling, but it has under-disclosed data-sharing paths involving molecular structures.

Review before installing if you work with proprietary or unpublished molecules. Use the local RDKit chain_entry path only for confidential compounds, avoid admetlab3.py unless third-party submission is acceptable, and inspect or remove the lab_hook dashboard integration if a neighboring pharmaclaw-lab-ui directory exists.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill broadens from ADME profiling into toxicity prediction and remote ADMETlab API use without declaring that expanded scope in the manifest. In a drug-discovery context, submitted molecules may be proprietary, so silent broadening increases data exposure and the chance users rely on outputs they did not intend to request.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The documented scripts advertise additional endpoints such as hERG, Ames, DILI, Caco-2, HIA, and oral bioavailability that are not declared in the manifest. This creates scope creep that can bypass expected review boundaries and mislead users about what information is collected, inferred, or transmitted.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill prepends a sibling project path and imports `lab_hook`, then sends analysis status and the canonical SMILES to that hook. This creates an out-of-scope data flow to an external component not described in the pharmacology profiling function, which can leak sensitive compound information or execute unintended code from a loosely trusted local path.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill does not warn that external ADMETlab API calls may transmit user-submitted molecular data off-system. In pharmaceutical workflows, SMILES can represent confidential compounds, so undisclosed outbound transmission creates a meaningful confidentiality and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends user-supplied SMILES to a third-party ADMETlab service without an explicit disclosure or consent mechanism. In a pharmacology and drug-candidate workflow, SMILES may represent proprietary or unpublished compounds, so silent external transmission can leak sensitive research data and violate data-handling expectations.

Static analysis

No suspicious patterns detected.