ClawHub
Back to skill

Security audit

Rstudio Research Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward R research workflow helper, but users should only run analyses and package installs in projects they trust.

Install only if you want an agent to run and modify R projects. Before asking it to execute scripts or render reports, make sure the project is trusted, because R scripts, .Rprofile, renv activation, R Markdown, and Quarto can run arbitrary code and may install packages or write files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly promotes running R scripts and rendering RMarkdown/Quarto documents, all of which execute code and can trigger arbitrary side effects such as file writes, package installs, shell calls, or network access. In a skill intended for automation, omitting a clear warning and trust boundary increases the chance a user will run unreviewed analysis content as if it were a safe, read-only operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly states that it saves outputs to files, but it does not warn users that activating the skill may create or modify files in the workspace. In a research/project automation context, this can lead to unintended changes such as overwriting results, creating new project artifacts, or altering repositories without the user's informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The surrounding documentation repeatedly states that the sub-skill supports exporting plots as PDF, PNG, SVG, and TIFF, but the provided save_publication_figure implementation hard-codes device = "pdf". This is an active contradiction between the documented intent and the code example users are instructed to use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill explicitly activates project environments, sources .Rprofile, and executes user/project-provided R, RMarkdown, or Quarto code, all of which can run arbitrary code with the agent's privileges and modify files or system state. The missing warning and lack of safety framing are dangerous because users may treat this as routine analysis execution rather than arbitrary code execution in a research project, increasing the chance of running untrusted or tampered project code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The README describes creating projects and exporting plots/reports without warning that these actions modify the user's workspace and create or overwrite files. While expected for this kind of skill, failing to disclose write behavior can still cause unintended changes, data loss, or confusion when used in an automated agent context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.