tracking-model-versions
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process metadata, metrics, and parameters from external model registries (such as MLflow and Weights & Biases), creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context via
mlflow.search_runs()and general model registry queries described inSKILL.mdandmodel_registry_client.py. - Boundary markers: There are no explicit instructions to the agent to ignore or delimit embedded instructions within the metrics or model cards it generates.
- Capability inventory: The skill is granted
Bash(cmd:*),Write, andEditpermissions, allowing it to perform file operations and execute system commands based on the data it processes. - Sanitization: The instructions do not define any validation or filtering logic for the hyperparameters, tags, or metadata retrieved from remote tracking servers.
Audit Metadata