querying-mlflow-metrics
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of a local script,
scripts/fetch_metrics.py, to retrieve and aggregate metrics from MLflow tracking servers. The script is invoked viapythonwith arguments for server configuration and metric selection.\n- [PROMPT_INJECTION]: The skill processes data from remote MLflow servers, which constitutes an indirect prompt injection surface. If a tracking server contains malicious data in trace names or assessment values, it could influence the agent's interpretation of the metrics.\n - Ingestion points: Data is fetched from the MLflow API at the URL provided in the
--serverargument, specifically targeting experiment metrics and trace attributes.\n - Boundary markers: No specific boundary markers or instruction-ignore tags are documented for handling external server responses.\n
- Capability inventory: The skill executes a local Python script to perform network queries and display results.\n
- Sanitization: The instructions do not describe any sanitization or validation of the retrieved server data.
Audit Metadata