ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

R Package Development — From Zero to CRAN & Bioconductor

v2.0.0

Build, check, and submit R packages to CRAN or Bioconductor. Use when creating a new R package from scratch, fixing R CMD check errors/warnings, preparing fo...

⭐ 0· 56·0 current·0 all-time
by@cuiweig
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description and the runtime instructions align: this is an instruction-only guide for building, testing, and submitting R packages to CRAN/Bioconductor and setting up CI. However, the SKILL.md directs uploads to an unexpected third-party URL (https://xmpalantir.wu.ac.at/cransubmit/) for CRAN submission. Official CRAN submissions normally use cran.r-project.org or the CRAN submission procedures; the provided URL does not match known official endpoints and is disproportionate to the stated purpose.
!
Instruction Scope
Most instructions stay on-topic (creating package skeleton, rcmdcheck, BiocCheck, GitHub Actions, S4 design). Concerning items: (1) telling users to upload tarball to https://xmpalantir.wu.ac.at/cransubmit/ and to follow a confirmation-email link — this could direct users to an untrusted endpoint; (2) recommending git filter-branch with forced push can rewrite repository history and is destructive if used incorrectly. The skill does not instruct arbitrary data collection, but the external submit endpoint and instructions that implicitly require user interaction with external sites are red flags.
✓
Install Mechanism
No install spec and no bundled code — instruction-only. That minimizes filesystem and execution risk because nothing is downloaded or installed by the skill itself.
✓
Credentials
The skill declares no required environment variables or credentials. Example CI snippets mention using GitHub Actions secrets (GITHUB_PAT/GITHUB_TOKEN) which is normal for CI; nothing in the skill unexpectedly requests unrelated credentials.
✓
Persistence & Privilege
always:false and no code means the skill does not request persistent system presence or elevated platform privileges. There is no code that would autonomously persist configuration or manipulate other skills.
What to consider before installing
This skill is a comprehensive, instruction-only guide for R package development and CI, and most content is consistent with that purpose. However: - Do not upload package tarballs to unfamiliar URLs. The SKILL.md repeatedly references https://xmpalantir.wu.ac.at/cransubmit/ for CRAN submission — this is not an official CRAN endpoint. Confirm CRAN submission URLs with the official CRAN documentation (cran.r-project.org) before uploading anything or entering credentials. - Treat links in the skill as untrusted until verified. If the process requires clicking a confirmation email or visiting an external site, confirm that the host is official. - Be careful with git filter-branch and git push --force: these rewrite history and can break collaboration if used incorrectly. Back up repositories before running those commands. - The CI examples refer to using GitHub Actions secrets (GITHUB_PAT / secrets.GITHUB_TOKEN) — that is normal, but never paste personal tokens into unverified web forms or third-party upload pages. Use GitHub Actions secrets to keep tokens safe. - If you plan to follow Bioconductor procedures, cross-check the steps with Bioconductor's official contribution docs (contributions.bioconductor.org) and the support site. Given the unexpected submission endpoint and the potentially destructive git advice, proceed only after verifying the external URLs and backing up your repository. If you can, ask the skill author (or source) to confirm the CRAN submission endpoint and the rationale for any nonstandard steps.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fhrtg138eh3w7sjez9bjh0d83sn4p

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments