ml-pipeline
Fail
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: CRITICALDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes numerous Python code templates and reference guides that implement object serialization using the pickle, joblib, and torch libraries. These serialization formats are vulnerable to insecure deserialization attacks, which can allow arbitrary code execution when loading maliciously crafted files.
- Evidence: Use of pickle.load() in the classmethod within references/feature-engineering.md.
- Evidence: Use of joblib.load() for model evaluation in references/pipeline-orchestration.md.
- Evidence: Use of torch.load() for checkpointing in references/training-pipelines.md.
- [EXTERNAL_DOWNLOADS]: The main skill file contains a documentation link to a GitHub Pages site that was flagged as malicious by automated scanners. While the domain aligns with the author's identity, the reputation warning suggests the link or its contents should be treated with caution.
- Evidence: External documentation link https://jeffallan.github.io/claude-skills/skills/data-ml/ml-pipeline/ found in SKILL.md.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata