Differential Gene Expression Analysis (RNA-seq)

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:32 PM UTC
• Version: 1.0.2

Overview

This skill is a scoped RNA-seq analysis workflow, but it installs unpinned R/Bioconductor packages at runtime and may not run reproducibly.

Install or run this only in a sandboxed R environment where network package installation is acceptable. For reproducible or sensitive work, preinstall the dependencies from trusted repositories, use pinned package versions or an renv lockfile, and avoid running it against private data until the empty input and missing main.R packaging mismatch are resolved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:25

Finding

Unpinned Third-Party Packages Are Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 25-29
Vulnerability Type: Runtime supply-chain exposure through mutable dependencies
Risk Level: Medium

Vulnerable Code

r

if (!require("BiocManager", quietly = TRUE)) {
  install.packages("BiocManager", repos = "https://cloud.r-project.org/")
}

BiocManager::install(c("DESeq2", "ggplot2", "pheatmap"), update = FALSE, ask = FALSE)

Technical Analysis

The documented workflow downloads and installs BiocManager, DESeq2, ggplot2, and pheatmap at runtime without pinning exact versions or validating package artifacts against trusted hashes. The repository uses HTTPS, and the referenced package names appear consistent with the skill's stated bioinformatics purpose; however, HTTPS alone does not guarantee that package contents will remain unchanged across executions.

The effective code executed by the skill can therefore change after review. R package installation and loading may execute package-controlled installation hooks, native code, and initialization logic under the privileges of the R process.

Attack Path

1. An operator invokes the documented skill in an environment where the required packages are absent or installation is otherwise triggered.
2. The R process connects to the configured CRAN repository and repositories selected by BiocManager.
3. Package versions are resolved dynamically because no lockfile, exact version constraints, or artifact hashes are provided.
4. If an upstream repository, package release, mirror, dependency, or package maintainer account is compromised, attacker-controlled package content may be returned.
5. The content executes during package installation or subsequent library(...) loading with the permissions and network access granted to the skill process.

This is a conditional supply-chain attack path; the audited files contain no evidence that the currently named packages or official repositories are malicious.

Impact Ass

...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve and install dependencies during a controlled build stage rather than during each skill execution.
2. Create and commit an renv.lock file that records exact R and package versions, including transitive dependencies.
3. Restore packages from a trusted, immutable package snapshot or internally controlled repository.
4. Verify downloaded package artifacts using approved checksums or signed repository metadata where available.
5. Prevent dependency updates during normal execution and review lockfile changes through the same security process as source-code changes.
6. Run package installation and analysis in a sandboxed, non-privileged environment with restricted filesystem and network access.
7. Separate the build environment from the runtime environment and make the runtime package library read-only.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs network package installation at runtime via install.packages() and BiocManager::install() without clearly disclosing this behavior in the user-facing description. This creates supply-chain and reproducibility risk because execution depends on fetching code from external repositories, which may be unavailable, changed, or compromised, and users are not explicitly warned that network access and third-party code execution will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.