The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process external datasets for AutoML training, which introduces a potential surface for indirect prompt injection. An attacker could provide a malicious dataset containing instructions intended to be executed or interpreted by the agent during the data preparation or model training phases.
Ingestion points: SKILL.md instructions (steps 6 and 7) describe loading training data and performing quality assessments using the Read tool.
Boundary markers: There are no explicit instructions or delimiters defined in the skill to treat the processed data as untrusted or to isolate it from the agent's logic.
Capability inventory: The skill possesses significant capabilities that could be misused if an injection succeeds, including Bash(python:*) permissions and a scripts/pipeline_deployment.py utility for recursive file operations.
Sanitization: While a data validation script (data_validation.py) is mentioned in the scripts/README.md as a means to prevent errors, its source code was not included in the analyzed files, leaving the actual implementation of data sanitization unverified.

building-automl-pipelines