The Agent Skills Directory

[DYNAMIC_EXECUTION]: The custom pyfunc model template in references/custom-pyfunc.md utilizes the pickle module to load preprocessor and booster artifacts during model initialization. If a model is registered with malicious artifacts, this results in arbitrary code execution during inference.
[DYNAMIC_EXECUTION]: The skill facilitates the 'Models from Code' pattern via python_model='model.py', which dynamically loads and executes Python classes from locally defined scripts in the serving environment.
[INDIRECT_PROMPT_INJECTION]: GenAI agent reference architectures in references/genai-agents.md and streaming feature definitions in references/feature-views.md establish ingestion points for untrusted data from Kafka event streams and Unity Catalog function outputs. These inputs are processed by LLM-based agents without explicit boundary markers or sanitization, making them vulnerable to indirect prompt injection attacks.
Ingestion points: ResponsesAgentRequest inputs and Kafka message payloads (value.* fields) processed by the agent graph.
Boundary markers: The provided LangGraph templates lack explicit delimiters or instructions to ignore embedded commands in external data.
Capability inventory: The agent context includes permissions for executing Unity Catalog functions, querying Vector Search indexes, and calling Foundation Model API endpoints.
Sanitization: The reference implementations do not demonstrate payload validation or escaping of external content prior to agent processing.
[COMMAND_EXECUTION]: The skill uses the Databricks CLI to perform file operations and job submissions, which involves local subprocess execution to interact with the Databricks workspace.

databricks-ml-training