The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The custom model template in 2-custom-pyfunc.md uses pickle.load() to deserialize preprocessors and models from file artifacts. This is a common pattern in MLflow but can lead to arbitrary code execution if the artifact files are compromised. Evidence: pickle.load(f) in 2-custom-pyfunc.md.
[COMMAND_EXECUTION]: An example tool in 4-tools-integration.md uses the eval() function to calculate mathematical expressions. While it attempts to restrict the environment by limiting __builtins__, dynamic execution of user-supplied strings carries inherent risk. Evidence: eval(expression, {"__builtins__": {}}, allowed) in 4-tools-integration.md.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several Python packages including mlflow, databricks-langchain, langgraph, and databricks-agents. These are well-known libraries relevant to the skill's purpose.
[PROMPT_INJECTION]: The GenAI agents described in 3-genai-agents.md ingest untrusted user messages via the ResponsesAgentRequest object. As these agents are designed to call tools, they are susceptible to indirect prompt injection where malicious data influences tool execution. 1. Ingestion points: request.input in 3-genai-agents.md. 2. Boundary markers: None identified. 3. Capability inventory: Tool calling (4-tools-integration.md), file uploads (SKILL.md), and command execution on clusters (SKILL.md). 4. Sanitization: No explicit sanitization is demonstrated in the examples.

databricks-model-serving