Small-molecule generation workflows combining REINVENT4, PocketXMol, Get Box, and Gnina Score through SciMiner.
Security Analysis
high confidenceThe skill is internally consistent with its stated purpose — it uses the SciMiner API for small-molecule workflows and only requests a single SciMiner API key — but it will upload molecular structures and related data to an external service (sciminer.tech), so you should only use it with data you trust sharing and with a trusted API key.
Name/description (small-molecule generation using REINVENT4, PocketXMol, Get Box, Gnina via SciMiner) matches the declared requirement: a single SCIMINER_API_KEY and registry entries describing those provider tools. Nothing else (extra cloud creds or unrelated binaries) is requested.
Runtime instructions explicitly direct the agent to call SciMiner endpoints (including file uploads) and to stop if SCIMINER_API_KEY is missing. This stays within the skill's stated purpose, but it means user files, PDBs, and generated molecules will be transmitted to sciminer.tech — a privacy/data-sharing consideration rather than a technical incoherence.
No install spec (instruction-only plus small registry code). Nothing is downloaded or written to disk by an installer; code files are simple registry metadata. This is low-risk from an install/execution perspective.
Only SCIMINER_API_KEY is required and it is the declared primary credential, which is proportionate for a skill that invokes a third-party API. No unexplained secrets or unrelated environment variables are requested.
Skill is not always-enabled and uses the platform default for autonomous invocation. It does not request elevated agent-wide persistence or modify other skills/config. No concerning privilege escalation is present.
Guidance
This skill is coherent and appears to do what it claims, but it sends uploaded structure files, generated molecules, and parameters to https://sciminer.tech using your SCIMINER_API_KEY. Only use it if you trust that third party with any proprietary or sensitive molecular data. Verify sciminer.tech and the API key source (privacy policy, data-retention practices, and intended API scopes). If you cannot share target structures or confidential data, test with non-sensitive examples first. If you need offline or local-only generation/validation, choose tools that run on your infrastructure instead of this skill. Finally, because the skill's source/homepage is unspecified, consider requesting provenance or an official homepage from the publisher before using it in production.
Latest Release
v1.0.1
- Clarified that the SciMiner API key is free in the prerequisites, instructions, and error messaging. - Updated instructional and error text to direct users to obtain a "free" SciMiner API key. - No workflow or behavioral logic was changed.
More by @sciminer
Published by @sciminer on ClawHub
