The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The Docker Compose configuration includes hardcoded credentials in environment variables (POSTGRES_PASSWORD: mlflow, MLFLOW_BACKEND_STORE_URI=postgresql://mlflow:mlflow@postgres:5432/mlflow). While these appear to be default values for a local development environment, hardcoding passwords in configuration files is a security risk.
[REMOTE_CODE_EXECUTION]: The functions load_model and load_model_version utilize mlflow.sklearn.load_model. This operation involves deserializing Python objects (typically using pickle), which can lead to arbitrary code execution if the model artifact being loaded has been tampered with or originates from an untrusted source.
[PROMPT_INJECTION]: The skill ingests untrusted data from an MLflow tracking server, such as experiment names, run tags, and model descriptions.
Ingestion points: Data is fetched via MlflowClient().search_runs and client.get_latest_versions in SKILL.md.
Boundary markers: Absent. The skill does not implement delimiters or instructions to ignore potential commands within the fetched metadata.
Capability inventory: The skill uses the Bash tool for operations like mlflow models serve.
Sanitization: Absent. There is no evidence of escaping or validation of the data retrieved from the MLflow backend.
[COMMAND_EXECUTION]: The skill explicitly uses the Bash tool to run commands for serving models and building container images, providing a potential path for command injection if parameters are not handled carefully.

mlflow