Running R Analysis In Existing Projects

• Analyzed: May 11, 2026, 4:49 AM
• Findings: 1
• Version: 0.1.0
• Hash: dce36b5ac79c811d36342017573e57d5991835c5012c87c3593cd751e593fc70
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its broad capabilities, which include modifying and executing arbitrary R scripts, installing R packages (implying network access), and rendering R Markdown/Quarto reports (implying shell execution). While these actions are plausibly needed for the stated purpose of R analysis, they represent significant high-risk behaviors and a potential attack surface for prompt injection or execution of malicious code present in a user's project. There is no evidence of intentional malicious behavior by the skill developer, but the inherent power granted to the agent makes it a vulnerability risk.