Molecular Docking AutoDock

实现分子对接全流程自动化，支持输入蛋白结构文件（PDB格式）、小分子SMILES表达式、口袋位置描述（文本描述或坐标范围），输出对接后打分最高的复合物结构及对接打分结果，默认使用AutoDock VINA算法。使用场景：用户需要进行蛋白-小分子对接预测结合模式、筛选小分子配体、获取对接复合物结构时触发。

This skill appears to implement the advertised docking workflow, but the Python script builds and runs shell commands (obabel, prank, vina) by interpolating user-supplied paths and descriptions into f-strings with subprocess.run(..., shell=True). That pattern allows command injection if a malicious or malformed file path/pocket string is provided. Before installing or running: (1) review the full scripts yourself or with a developer; (2) run the skill in an isolated environment or container; (3) avoid supplying untrusted file paths or freeform text as the pocket argument; (4) consider patching the code to call external programs with argument lists (subprocess.run([...], shell=False)) or to sanitize/quote inputs (shlex.quote) and validate paths; (5) ensure you trust the binaries you install (conda packages and the p2rank tarball). If you cannot review or sandbox it, treat it as risky for use with sensitive systems or data.

Type: OpenClaw Skill Name: molecular-docking-autodock Version: 1.0.0 The skill contains multiple shell injection vulnerabilities in `scripts/molecular_docking.py` due to the use of `subprocess.run(shell=True)` with unsanitized file paths in commands for `obabel` and `prank`. While the workflow for molecular docking and the use of tools like AutoDock VINA and p2rank appear legitimate for scientific purposes, the lack of input sanitization on filenames could allow for arbitrary command execution. No evidence of intentional malicious behavior or data exfiltration was detected.