R ggplot Quickplot

上传 CSV 数据文件，自动生成 9 种常用 ggplot2 图表（散点图、柱状图、箱线图、折线图、直方图、分面图等）。零代码可视化，支持 Docker/Singularity 免安装运行。

Key things to consider before installing or running this skill: - Do not run the build/run scripts blindly. The package references run_plot.R, Dockerfile, and Singularity.def, but those files are missing from the manifest — the tool cannot run as advertised until you obtain or inspect run_plot.R and the image definitions. - If you plan to build or run the Docker/Singularity modes, review the Dockerfile / Singularity.def and the R script (run_plot.R) first to ensure they do not execute unexpected network calls, remote code, or read sensitive host files. The current scripts will mount/copy your input and output directories into containers, giving containerized code access to those files. - Pushing images requires DOCKER_USERNAME (optional). Only set/publish to your own account after inspecting the image contents and ensuring no secrets are baked in. - Because the source is marked 'unknown' and critical runtime files are absent, consider contacting the author or using a trusted fork. If you need to test, run it in a contained environment (throwaway VM or sandbox) and with non-sensitive sample data until you have inspected run_plot.R and any image build files. - If you want a go/no-go decision: this package is suspicious (incoherent packaging). It could be an incomplete upload rather than malicious, but you should obtain the missing files and review them before use.

Type: OpenClaw Skill Name: r-ggplot-quickplot Version: 3.1.0 The skill bundle contains shell scripts (run_docker.sh, run_singularity.sh, and run.sh) that are vulnerable to shell injection because they do not sanitize the input file path argument before using it in command substitutions and path evaluations. Additionally, the scripts automatically invoke 'install.packages' in R, which presents a supply chain risk by executing code from external repositories during setup. While these appear to be unintentional security flaws rather than intentional malware, they constitute high-risk behaviors in an automated agent environment.