R ggplot Quickplot

• Analyzed: Mar 22, 2026, 2:36 AM
• Findings: 1
• Version: 3.1.0
• Hash: 7965e2b44ab7b6aaea9a31fe3b02de38cfa23d81ef92e5a32704f5f231cc4a79
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains shell scripts (run_docker.sh, run_singularity.sh, and run.sh) that are vulnerable to shell injection because they do not sanitize the input file path argument before using it in command substitutions and path evaluations. Additionally, the scripts automatically invoke 'install.packages' in R, which presents a supply chain risk by executing code from external repositories during setup. While these appear to be unintentional security flaws rather than intentional malware, they constitute high-risk behaviors in an automated agent environment.