Security audit

R Machine Learning Workbench

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local R machine-learning workbench, but it has material install and input-handling risks that could execute mutable third-party code or write files outside the intended output area.

Install only in an isolated R environment and avoid running it on untrusted datasets or attacker-supplied column names. Review or pin the GitHub dependency before using the install command, and use simple alphanumeric tags until path validation is added. Expect output files to contain dataset-derived values, including raw train/test splits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: scripts/install_packages.R:101
Finding: Unpinned GitHub Dependency Enables Mutable Remote Code Execution
Content: View full analysis
Remediation: View remediation
", quiet = TRUE ) ``` 2. Prefer a trusted package registry with immutable versioning when an appropriate package is available. 3. Record exact package versions and sources in `renv.lock` or an equivalent dependency lockfile. 4. Verify downloaded artifacts against a published SHA-256 checksum or trusted signature. 5. Confirm and document which package the repository installs and why it provides `xgboost.surv`. 6. Avoid automatically falling back to GitHub during routine installation. Require explicit user confirmation for non-registry dependencies. 7. Review package installation hooks and transitive dependencies before updating the pinned revision. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pipeline.R:14
Finding: User-Controlled Output Tag Permits Path Traversal and Arbitrary File Placement
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rf_model.R:12
Finding: Unquoted Column Names Enable R Formula Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The README presents key usage headings and command guidance such as 速查, 首次使用, 全流程一键, and other operational labels only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and main documentation are written as Chinese-first instructions and present the skill as producing reports and outputs in that context, without stating that users may choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The pipeline persists train/test splits and later prediction tables to disk, which can include raw feature values, labels, and potentially sensitive or regulated data. In an ML skill context this is risky because users may run the pipeline on proprietary, personal, or confidential datasets and may not expect broad local persistence of those records in output artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script handles mismatched prediction and truth datasets by truncating the longer input to the shorter one based solely on row order, after only an informational message. This can silently misalign labels and predictions or discard records, producing incorrect ROC/PR metrics and misleading output artifacts without forcing the user to acknowledge the data integrity problem.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This branch installs an R package at runtime with install.packages(), which modifies the execution environment and performs network-dependent code acquisition during analysis. In an agent skill context, that expands the script's privileges beyond model training and can lead to unreviewed dependency execution, nondeterministic behavior, and policy bypass if package sources or mirrors are compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The XGBoost code path also uses install.packages() at runtime, enabling environment mutation and fetching executable third-party code while processing user-selected model options. Even if intended for convenience, this is risky in an automated agent environment because it introduces supply-chain exposure and allows a data-analysis task to change the host state.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module header explicitly states that supported kernels include sigmoid, creating a documented expectation that users can select it. However, the kernel-selection logic implements only linear, radial, and polynomial, and the fallback stop() message excludes sigmoid, so the documentation actively contradicts the actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing safety warnings. The README tells users to run launcher.sh install and a one-click pipeline, but it does not warn that these actions will modify the R environment by installing packages and will write models, reports, plots, and CSV outputs to the filesystem.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code saves a final CSV of selected features, and elsewhere in the file it also saves models and plots, which are file-writing operations. While there are save messages after some writes, there is no clear user-facing disclosure here about whether existing files may be overwritten or that multiple artifacts will be created on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This shell script immediately creates multiple directories under the project output path, which is a file-system write operation. Although the usage text describes available commands, it does not explicitly warn users that running the launcher will modify the local workspace even before command dispatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script writes a generated R Markdown report to disk via writeLines, but there is no prior prompt or explicit disclosure in comments/docstrings that the skill will create files in the output directory. Although a saved-path message is emitted afterward, that is not a warning before the file-write action occurs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The call to rmarkdown::render produces an HTML output file, which is another filesystem write with no confirmation prompt and no explanatory docstring/comment describing that the script will generate output artifacts. The script logs success after rendering, but does not warn the user beforehand.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script saves prediction CSVs, the trained model, and preprocessing objects to disk via save_csv and save_model. While these writes are part of a training workflow, this file does not include any explicit user disclosure about where outputs will be written or that derived data artifacts will be persisted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.