ml-engineer
Warn
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts 'scripts/train_sklearn.py' and 'scripts/tune_hyperparameters.py' use 'joblib.load()' to deserialize model artifacts and optimization studies. Since 'joblib' relies on 'pickle' internally, it is susceptible to arbitrary code execution if a maliciously crafted file is loaded from an untrusted source.
- [PROMPT_INJECTION]: The RAG pipeline in 'SKILL.md' (Workflow 5) retrieves content from 'raw_documents' and passes it to an LLM chain without sanitization or strict boundary markers. This exposes the agent to indirect prompt injection where hidden instructions in documents could manipulate agent behavior. Ingestion points: 'raw_documents' processed in 'SKILL.md'. Boundary markers: None identified; data is interpolated directly into the chain. Capability inventory: OpenAI and Pinecone API access, local file system writes via training scripts. Sanitization: No input validation or filtering of retrieved content.
- [PROMPT_INJECTION]: The monitoring workflow in 'SKILL.md' (Workflow 3) ingests 'production logs' for drift analysis. If log data is attacker-controlled, it could contain instructions that influence the agent's logic during the monitoring process. Ingestion points: 'load_production_logs()' function in 'SKILL.md'. Boundary markers: None identified. Capability inventory: Retraining script triggers and alerting mechanisms. Sanitization: No validation of log data content.
Audit Metadata