Paramus Professional Chemistry OS
v1.0.7Hundreds of chemistry and scientific computing tools. Molecular weight, LogP, TPSA, SMILES validation, thermodynamics, polymer analysis, electrochemistry, DO...
⭐ 3· 742·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the instructions: the skill is explicitly a bridge to the Paramus chemistry API and therefore reasonably needs a network client (curl) and an API token for cloud mode. However, the skill's registry metadata marks PARAMUS_API_TOKEN as required while the SKILL.md supports a local-only mode that does not need a cloud token — making the 'required env var' declaration inconsistent with the documented operation.
Instruction Scope
SKILL.md contains a CRITICAL INSTRUCTION mandating that the agent MUST call the Paramus API for any chemistry/science question and must not answer from its own knowledge. That directs the agent to transmit user-provided chemical data to an external service (cloud1.paramus.ai) unless a local server is available. While the doc asks the agent to prefer local mode and to inform the user before making cloud calls, the mandatory nature of API use plus the agent's ability to act autonomously increases the risk of sending sensitive chemical data without explicit, per-call user confirmation.
Install Mechanism
This is instruction-only (no install spec, no code files). No downloads or installers are specified, so nothing is written to disk by the skill itself — low install risk.
Credentials
The only declared required env var is PARAMUS_API_TOKEN, which is appropriate for cloud mode. But documentation shows that a local Paramus server can be used without a token; declaring the token as required is inconsistent and could pressure users into supplying a cloud credential even when local-only use would suffice. Requiring a bearer token grants the skill the ability to send potentially sensitive molecule/formulation data to a remote service — this is proportionate only when the user expects cloud processing and consents explicitly.
Persistence & Privilege
always is false (normal). The skill allows autonomous invocation (disable-model-invocation=false), which is expected for skills, but combined with the mandatory instruction to always call the API and with possession of a cloud token, an autonomously-invoking agent could repeatedly call the external API. This increases the blast radius for accidental or undesired data transmission; it's not by itself malicious but worth caution.
What to consider before installing
This skill routes chemistry questions to Paramus and will send molecule/formulation data to a Paramus endpoint when local mode isn't available. Before installing: (1) confirm you trust the Paramus cloud endpoint and the skill owner (registry metadata is sparse); (2) do not supply PARAMUS_API_TOKEN unless you consent to cloud processing of your chemical data — prefer local mode for sensitive chemistry; (3) ask the skill author to make cloud calls explicitly user-confirmed rather than mandatory, and to fix the metadata inconsistency that marks the token as required even though local mode works without it; (4) if you handle proprietary molecules or regulated compounds, avoid providing an API token or deny the skill network access unless you run the local Paramus server. If you want higher assurance, request provenance (source code, homepage, or organization) and a privacy/security policy from the publisher.Like a lobster shell, security has layers — review code before you run it.
latestvk977bxjr371jqc1e00p0n3t8m181989v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚗ Clawdis
Any bincurl
EnvPARAMUS_API_TOKEN
Primary envPARAMUS_API_TOKEN