The Agent Skills Directory

[COMMAND_EXECUTION]: Static analysis identified several instances of backtick usage and shell-like patterns. However, these are false positives: they represent Markdown fenced code blocks (e.g., ```python```) used for documentation examples or inline code references (e.g., `scripts/init_model_template.py`) in the skill description. There is no evidence of actual shell invocation or arbitrary command execution.
[REMOTE_CODE_EXECUTION]: No patterns of downloading and executing external scripts (e.g., curl|bash) were found. The skill uses the claude_agent_sdk to spawn a specialist agent, which is a standard pattern for multi-agent workflows.
[DATA_EXFILTRATION]: No evidence of sensitive data access or exfiltration. The skill defines structured communication for ML requirements (parameters, architectures, existing code snippets) but does not attempt to access credentials, environment files, or unauthorized network endpoints.
[PROMPT_INJECTION]: The specialist prompt in agents/ml-expert-specialist.prompt contains instructions to operate in 'plan mode' and follow specific methodologies. These are functional guidelines for the agent specialist and do not attempt to bypass safety filters or override global agent constraints.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements and existing code. While this represents a data ingestion surface, the risk is assessed as safe because the processing is limited to generating code structures and implementation plans within a controlled specialist prompt framework. Standard boundary markers are implied by the SDK usage.

ml-expert