r-package-development
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines templates for executing R code and package tests using
Rscript. It also incorporates a command namedairfor formatting files. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with user-controlled R package files and uses placeholder-based templates for shell command execution, which could be exploited if malicious content is processed.
- Ingestion points: R package source files in the
R/directory, test files intests/testthat/, and the_pkgdown.ymlconfiguration file. - Boundary markers: The instructions do not provide specific delimiters or ignore-instructions warnings for the data being processed.
- Capability inventory: The skill allows for the execution of arbitrary R code and shell commands via
Rscriptand file modification via theairformatter. - Sanitization: No instructions for sanitizing or validating user-provided variables (such as
{name}) are present before their interpolation into shell commands.
Audit Metadata