The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The MLModelCache class utilizes pickle.load and pickle.loads to deserialize machine learning models from the local file system and the Redis cache. The pickle module is inherently unsafe as it can be exploited to execute arbitrary code during the deserialization process. If an attacker can modify the cached data or the files in the model store, they could achieve code execution on the system running the agent.
[PROMPT_INJECTION]: The skill facilitates the ingestion and caching of untrusted external data (such as database query results in QueryCache and user-provided features in FeatureCache) without implementing sanitization, validation, or boundary markers. This creates a surface for indirect prompt injection where malicious instructions stored in the cache could influence the agent's behavior when the data is retrieved and processed.
Ingestion points: Untrusted data enters the context through MLModelCache.get_model (from disk/cache), FeatureCache.get_features (from cache), and QueryCache.execute_cached (from cache).
Boundary markers: No delimiters or instructions are provided to the agent to treat cached content as untrusted data.
Capability inventory: The skill provides capabilities for database interaction via SQLAlchemy and Redis management, but does not include direct subprocess execution outside of the inherent risks in the provided Python snippets.
Sanitization: There is no evidence of HTML escaping, SQL parameter validation beyond standard SQLAlchemy usage, or filtering of cached content.

loom-caching