The Agent Skills Directory

[COMMAND_EXECUTION]: Unsafe deserialization in model loading functionality.
File: references/EXAMPLES.md
Evidence: The load_model function in ab_test/traffic_router.py utilizes joblib.load(path). Since joblib uses pickle-based serialization, loading a model file from an untrusted or compromised source allows for arbitrary code execution on the host system.
[COMMAND_EXECUTION]: Potential SQL injection surface in data analysis components.
File: references/EXAMPLES.md
Evidence: The load_experiment_data method in ab_test/analysis.py demonstrates the construction of SQL queries using f-string interpolation for experiment_name, start_date, and end_date. If these parameters are derived from untrusted user input without sanitization, it creates a risk of SQL injection.
[DATA_EXFILTRATION]: Design patterns for external data transmission.
File: references/EXAMPLES.md
Evidence: The implementation includes stubs for log_experiment_event and _send_to_analytics which are explicitly intended to send prediction results, features, and outcomes to external systems like Kafka, S3, or databases. While currently implemented as loggers, the architecture is designed to facilitate the exfiltration of sensitive model performance and user data.

run-ab-test-models