The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides numerous code templates that rely on unsafe deserialization functions, including pickle.load(), joblib.load(), and torch.load(). These methods are vulnerable to arbitrary code execution if the input files (models or pipeline states) are sourced from untrusted environments or have been tampered with.
Evidence in SKILL.md: The Kubeflow component template uses pickle.dump, implying a corresponding load operation.
Evidence in references/feature-engineering.md: The FeaturePipeline.load method explicitly uses pickle.load(f) to restore pipeline state.
Evidence in references/pipeline-orchestration.md: The evaluate_model and train_model components use joblib.load and joblib.dump for model persistence.
Evidence in references/training-pipelines.md: The Trainer.load_checkpoint method uses torch.load(), which by default uses pickle for deserialization.
[EXTERNAL_DOWNLOADS]: The skill's orchestration templates (specifically for Kubeflow) use the packages_to_install parameter, which triggers the dynamic installation of Python packages from public registries at runtime. While the example packages are standard ML libraries, this mechanism allows the execution of external code during pipeline runs.
Evidence in SKILL.md: packages_to_install=["scikit-learn", "mlflow"] in the train_model component.
Evidence in references/pipeline-orchestration.md: Multiple components define runtime dependencies via the @component decorator.
[INDIRECT_PROMPT_INJECTION]: The skill designs pipelines that ingest external data, creating an attack surface for indirect injection where malicious data could influence model behavior or pipeline execution logic.
Ingestion points: Data ingestion occurs via pandas.read_csv and pandas.read_parquet in SKILL.md and references/pipeline-orchestration.md.
Boundary markers: The skill suggests using Great Expectations for data validation, which enforces schema boundaries but does not necessarily sanitize against adversarial payloads.
Capability inventory: The skill utilizes powerful orchestrators (Kubeflow, Airflow, Prefect) capable of executing shell commands and performing file operations based on pipeline results.
Sanitization: Validation focuses on statistical distribution and schema integrity (e.g., null checks, range checks) rather than content sanitization for downstream agent processing.
[DATA_EXFILTRATION]: The skill integrates with remote experiment tracking platforms such as MLflow and Weights & Biases. While standard for MLOps, these integrations facilitate the transmission of local metrics, parameters, and model artifacts to remote servers.
Evidence in references/experiment-tracking.md: Implementation of mlflow.set_tracking_uri() and wandb.init() wrappers for logging data to external endpoints.

ml-pipeline