Skillv0.1.0

ClawScan security

Debugging R Environment And Dependencies · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 26, 2026, 10:00 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only skill whose requests and actions (checking R, inspecting renv.lock, proposing OS-specific system-package and compiler installs, running renv::restore, etc.) are coherent with its stated purpose and it does not request unrelated credentials or install arbitrary external code.
Guidance: This skill appears to be what it claims: a troubleshooting guide for R environments. Things to keep in mind before using it: (1) many suggested fixes involve running OS package-manager commands (sudo apt / brew / dnf) and installing compilers—review any commands before executing them and run on a machine where you have permission to install system packages; (2) renv operations and lockfile updates will change project state—commit or back up your repo before making changes; (3) the skill does not ask for API keys or secrets, but some fixes (e.g., rJava) may require installing external software like a JDK—verify sources yourself; (4) if you want extra safety, have the skill produce the exact commands it would run and run them manually rather than allowing autonomous execution.

Purpose & Capability: okName/description match the actual instructions: the skill diagnoses R version/package/renv/Bioconductor issues and proposes installing system libraries and compilers when needed. All required actions are proportional to fixing R environment problems.
Instruction Scope: okSKILL.md stays within scope: it lists commands to check R and project files (renv.lock), suggests OS-specific package-manager commands, and recommends renv and BiocManager operations. It does not instruct reading unrelated system files, accessing external endpoints, or exfiltrating secrets.
Install Mechanism: okInstruction-only skill with no install spec and no code files; nothing is downloaded or written by an installer. Risk from installation is low because the skill only suggests standard OS package-manager commands (apt/brew/dnf) rather than pulling archives from arbitrary URLs.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. It may suggest system-level installs that require elevated privileges (sudo), which is appropriate for installing compilers or system libs but not a secret-exfiltration risk.
Persistence & Privilege: okalways is false and the skill does not request persistent agent privileges or modify other skills' configs. Autonomous invocation is allowed by platform default but is not unusual here and does not combine with other red flags.