Differential Gene Expression Analysis (RNA-seq)

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:33 PM UTC
• Version: 1.0.1

Overview

This skill appears to be a straightforward RNA-seq analysis helper, but it installs unpinned R/Bioconductor packages at runtime.

Install or run this in a contained R environment if possible. Be aware that it may download and install current CRAN/Bioconductor packages, and review or pin package versions if reproducibility matters. The included input CSV is empty, so you will need valid count data for the analysis to succeed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:25

Finding

Unpinned Third-Party Packages Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 25–29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

r

if (!require("BiocManager", quietly = TRUE)) {
  install.packages("BiocManager", repos = "https://cloud.r-project.org/")
}

BiocManager::install(c("DESeq2", "ggplot2", "pheatmap"), update = FALSE, ask = FALSE)

Technical Analysis

The Skill installs BiocManager, DESeq2, ggplot2, and pheatmap dynamically without pinning exact versions or verifying package integrity. Consequently, the code reviewed during the audit does not fully determine the code that will execute during a future Skill run.

Although the configured CRAN repository and package names appear legitimate and no malicious dependency was identified in the supplied project, the installation mechanism relies on mutable external repositories. A compromised repository, dependency takeover, malicious future release, or altered dependency resolution could introduce attacker-controlled code. R packages can execute code during installation and when loaded, giving a compromised package access to the permissions and environment of the R process.

Attack Path

1. An attacker compromises an upstream package, one of its transitive dependencies, or the repository infrastructure used for package resolution.
2. The attacker publishes or serves a malicious package version under a dependency name accepted by the unpinned installation process.
3. An agent follows the instructions in skill.md and invokes the runtime installation commands.
4. BiocManager resolves and downloads the currently available mutable package versions rather than versions previously reviewed and locked.
5. Attacker-controlled package code executes during installation or when the subsequent library(...) statements load the package.
6. The malicious code operates with the R process's permissions and can access files, e ...[truncated 1006 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin exact direct and transitive dependency versions using an renv.lock file or an equivalent dependency lock mechanism.
2. Use a fixed, trusted CRAN/Bioconductor snapshot rather than resolving packages from mutable current repositories.
3. Verify downloaded package checksums or signatures against values committed to and reviewed with the Skill.
4. Move dependency installation to a controlled build phase instead of installing packages whenever the Skill executes.
5. Build and publish a reproducible runtime image containing pre-reviewed dependencies.
6. Run the Skill in an isolated, least-privileged environment with restricted filesystem access, no unnecessary credentials, and network access disabled after dependency provisioning.
7. Regularly scan and update the lockfile through a reviewed dependency-management process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill performs package installation at runtime, which modifies the execution environment and reaches out to external repositories without disclosing that behavior in the user-facing description. This is dangerous because it introduces supply-chain and reproducibility risks, can unexpectedly change system state, and may fail or install unreviewed code in restricted environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file includes only Chinese-language descriptive comments for the listed files and directories, which imposes a specific language/locale without any opt-in or alternative. Under the policy, language constraints should be optional or clearly justified, and no such justification appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The code creates an output directory and writes several files, but the description only lists outputs and does not explicitly warn that execution will create or overwrite local files. For markdown-scoped warning review, behaviors that modify local data should be clearly disclosed to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.