PharmGx Reporter

Pharmacogenomic report from DTC genetic data (23andMe/AncestryDNA)

This package appears internally consistent and runs locally on a genotype text file to produce a research/educational PGx report. Before using: (1) do not treat output as clinical advice—follow the included disclaimer; (2) inspect pharmgx_reporter.py for any network calls or logging you don't want (the provided snippets show none, but review the whole file); (3) run the included tests in an isolated environment to confirm behavior; (4) avoid uploading real patient-identifiable data to untrusted systems—operate on de-identified files or in a secure local environment; (5) if you plan to use in a clinical context, consult qualified clinical genetics/pharmacology resources and validate against authoritative CPIC guidelines.

Type: OpenClaw Skill Name: pharmgx-reporter Version: 0.2.0 The `pharmgx_reporter.py` script is vulnerable to path traversal. It directly uses user-provided `--input` and `--output` file paths from command-line arguments without explicit sanitization. This allows a malicious actor to potentially read or write arbitrary files on the system (e.g., `--input ../../../etc/passwd` or `--output ../../../tmp/evil.md`) by crafting the input arguments. While the script's core functionality is benign and intended for pharmacogenomic reporting, this lack of input sanitization represents a significant vulnerability, classifying it as suspicious rather than benign or malicious.