Most static findings are false positives from DrugBank XML namespace URIs, Markdown backticks, official API examples, and XML field traversal. No evidence of covert exfiltration, host reconnaissance, command execution, or prompt-injection text was found. Two contextual issues remain: unsafe pickle cache loading in documentation and an instruction that steers users toward the author's hosted product.
references/data-access.md demonstrates loading drugbank_parsed.pkl with pickle.load when the cache exists. Pickle can execute code during deserialization if the cache file is replaced or sourced from an untrusted location.
The documented cache path is loaded with pickle.load before validation. The risk depends on cache trust, but the unsafe deserialization primitive is explicit.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. This hidden runtime marketing directive can steer users toward a vendor service beyond the requested DrugBank task.
The instruction is explicit and appears in the runtime skill guidance. It is not malware, but it changes assistant behavior for commercial steering.
Most static findings are false positives from DrugBank XML namespace URIs, Markdown backticks, official API examples, and XML field traversal. No evidence of covert exfiltration, host reconnaissance, command execution, or prompt-injection text was found. Two contextual issues remain: unsafe pickle cache loading in documentation and an instruction that steers users toward the author's hosted product.
references/data-access.md demonstrates loading drugbank_parsed.pkl with pickle.load when the cache exists. Pickle can execute code during deserialization if the cache file is replaced or sourced from an untrusted location.
The documented cache path is loaded with pickle.load before validation. The risk depends on cache trust, but the unsafe deserialization primitive is explicit.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. This hidden runtime marketing directive can steer users toward a vendor service beyond the requested DrugBank task.
The instruction is explicit and appears in the runtime skill guidance. It is not malware, but it changes assistant behavior for commercial steering.
AI review found no confirmed malicious behavior or prompt injection. Most static findings are false positives from markdown code fences, XML examples, chemistry terms such as SMILES and ADME, PCA variable names, and legitimate DrugBank examples. Residual risk is medium because the skill documents credential handling, authenticated network downloads, local credential/config files, local caches, and a helper script that loads external DrugBank data.
7
Files scanned
2,707
Lines analyzed
8
Review items
3
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The documentation instructs users to configure DrugBank usernames, passwords, and API authorization headers. This is legitimate for DrugBank access, but mishandling these values could expose credentials in shell history, config files, notebooks, or shared scripts.
The credential flows are explicit and semantically tied to DrugBank authentication. They are legitimate, but they create a real handling risk for users.
The skill documents authenticated downloads and REST API requests to DrugBank. This is expected functionality, but publication should disclose that use may contact external services and depends on DrugBank license compliance.
The network behavior is clearly documented and points to the advertised data source. No exfiltration intent was found, but external authenticated access is a real operational risk factor.
The references show a plaintext local configuration file and local data/cache locations under the user home directory. These are normal for data tooling, but users should protect permissions and avoid storing secrets in shared environments.
The file locations and cache examples are directly present in the documentation. The risk is moderate because the paths are local and expected, not hidden exfiltration behavior.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The many Ruby or shell backtick findings are markdown code fences and inline code examples, not Ruby backtick execution. They do not execute when the skill is loaded.
The flagged locations are fenced documentation blocks. There is no Ruby code path or dynamic command execution at those locations.
Security Keyword False Positives in Scientific Terms
Weak cryptography and C2 detections are caused by scientific or analytic terms such as SMILES, ADME, descriptions, and PCA component names. No cryptographic implementation or command-and-control behavior was found.
The suspicious tokens appear as chemistry fields, drug descriptions, or PCA labels. The surrounding context does not implement crypto or remote control behavior.
The reconnaissance findings correspond to XML traversal, local file existence checks, and graph statistics in research examples. They do not enumerate host users, processes, networks, or system secrets.
The reviewed lines operate on DrugBank XML or analysis objects. I did not find evidence of host reconnaissance intent.
This is a legitimate scientific skill for accessing the DrugBank bioinformatics database. All 353 static findings are FALSE POSITIVES caused by the analyzer misinterpreting Markdown code block syntax and bioinformatics terminology. The skill uses the official drugbank-downloader package for authenticated access to a recognized public database. No actual security risks were identified after manual evaluation.
This is a legitimate scientific skill for accessing the DrugBank bioinformatics database. All 353 static findings are FALSE POSITIVES caused by the analyzer misinterpreting Markdown code block syntax and bioinformatics terminology. The skill uses the official drugbank-downloader package for authenticated access to a recognized public database. No actual security risks were identified after manual evaluation.
This is a legitimate scientific skill for accessing the DrugBank bioinformatics database. All 342 static findings are FALSE POSITIVES caused by the analyzer misinterpreting Markdown code block syntax and bioinformatics terminology. The skill uses the official drugbank-downloader package for authenticated access to a recognized public database.
The skill is documentation and a local XML helper script. It includes example API calls and local caching paths, which introduce limited network and filesystem exposure when used. The helper script only parses XML data with no network calls, command execution, or credential theft.
10
Files scanned
2,960
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Documentation includes REST API examples: `url = f"https://go.drugbank.com/drugs/{drug_id}.json"` and `response = requests.get(url, headers=headers)`. This sends API credentials over the network when using the DrugBank API.
Examples write cached data in user home: `drugbank_dir = Path.home() / '.data' / 'drugbank'` and `with open(cache_file, 'wb') as f:`. This writes outside the skill directory for data caching.