Running R Analysis In Existing Projects

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:37 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward R-project analysis helper; it can modify project outputs and install R packages, but those actions are disclosed and aligned with its stated purpose.

Install this skill only in projects where you are comfortable letting the agent read and edit analysis scripts, reports, and generated results. Use version control or backups before reruns, and require the agent to show exact package installs or output overwrites before proceeding.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:127
• Finding: Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:127-133` **Vulnerability Type**: Unpinned dependency installation from external package repositories **Risk Level**: Medium ### Vulnerable Code ```r ### Installing Missing Packages ```r # Skill detects and installs missing packages install.packages("lme4") # For mixed models # Or Bioconductor BiocManager::install("DESeq2") ``` ``` ### Technical Analysis The documented workflow directs the agent to install third-party R packages without specifying package versions, validating package integrity, enforcing trusted repository URLs, or restoring dependencies from a reviewed lockfile. Both `install.packages()` and `BiocManager::install()` resolve packages and their transitive dependencies using the repositories configured in the active R environment. R package installation can execute package build or installation logic. Consequently, the effective code installed depends on mutable external repositories and local repository configuration at the time the command is run. The README is documentation rather than an executable script, so exploitation requires the skill or an operator to follow this workflow. Nevertheless, the skill explicitly claims that it detects and installs missing packages, making unsafe dependency installation part of the described operating procedure. ### Attack Path 1. An attacker compromises a configured package repository, publishes a malicious dependency through a dependency-confusion or similarly unsafe resolution path, or modifies the target project's R repository configuration. 2. The agent encounters a missing package while modifying or rendering the R project. 3. Following the documented workflow, the agent runs `install.packages("lme4")`, `BiocManager::install("DESeq2")`, or an equivalent unpinned installation command. 4. R resolves the requested package and transitive dependencies from the attacker-influenced source. 5. Malicious package code executes during inst ...[truncated 966 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace ad hoc package installation with a reviewed `renv.lock` file and use `renv::restore()` to reproduce approved dependency versions. 2. Pin exact package versions and review transitive dependency changes before installation. 3. Configure explicit, trusted HTTPS repository URLs rather than accepting repositories inherited from an uncontrolled project or user environment. 4. Require explicit user approval before installing or upgrading any package. 5. Run dependency installation and report rendering in an isolated container or sandbox with minimal filesystem access, no unnecessary credentials, and restricted network access. 6. Separate dependency restoration from analysis execution so package changes are visible and auditable. 7. Record package sources, versions, repository metadata, and lockfile changes in version control. 8. Where practical, verify downloaded package integrity using trusted repository metadata or approved artifact hashes. 9. Update the documentation to state that project-controlled repository configuration must be reviewed before any installation command is executed. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that the skill will re-run analyses, regenerate plots, and re-render reports, which implies modifying project files and overwriting generated artifacts. In a code-editing skill this behavior is expected, but the lack of any warning, confirmation step, or backup guidance creates a real safety risk because users may lose prior outputs or unintentionally apply broad changes across an existing project.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README says the skill detects and installs missing packages, including from CRAN and Bioconductor, but does not warn that this changes the user's R environment and may introduce unreviewed dependencies. In an existing project context, environment mutation can break reproducibility, alter locked dependency state, or execute package installation hooks without the user clearly consenting.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly states it may recompute results, overwrite outputs in `results/`, and re-render reports, but it does not require explicit confirmation, backups, or a dry-run before modifying project artifacts. In an existing analysis project, this can unintentionally destroy prior outputs, replace trusted reports, or make it harder to distinguish original results from agent-generated changes.

Static analysis

No suspicious patterns detected.