The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): scripts/init_project.py installs the flowerpower package using pip without verifying the source or integrity, which is a concern for unverifiable dependencies.
COMMAND_EXECUTION (MEDIUM): Multiple scripts (create_pipeline.py, init_project.py, run_pipeline.py) use subprocess.run to execute the flowerpower CLI. While using list-based arguments, these operations still permit system-level interactions based on agent-generated paths.
REMOTE_CODE_EXECUTION (HIGH): The framework's architecture depends on dynamic code loading. It imports modules via additional_modules and executes callback functions specified by name in the configuration (e.g., on_success, on_failure). This creates a direct path for execution of arbitrary code provided in YAML configs.
PROMPT_INJECTION (HIGH): The skill exhibits a large surface for indirect prompt injection. In run_pipeline.py, the --inputs and --run-config arguments accept JSON/YAML that the agent processes into the execution environment. Lack of sanitization allows malicious instructions to influence the Hamilton DAG or trigger dangerous function calls.
DATA_EXFILTRATION (MEDIUM): Configuration settings like api_url in project.yml for trackers (e.g., Hamilton tracker, MLflow) could be redirected to attacker-controlled endpoints to leak data processed within pipelines.

flowerpower