The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions and documentation describe workflows that ingest external, untrusted data which can serve as a vector for indirect prompt injection.
Ingestion points: The skill processes external data via pd.read_csv('data.csv') in references/common_workflows.md and mentions loading datasets through standard scikit-learn utilities.
Boundary markers: There are no explicit instructions to use boundary markers or delimiters when processing this data.
Capability inventory: The skill environment (as defined in SKILL.md) includes tools for Bash, Write, and Edit, which could be exploited if an injection in processed data influences agent behavior.
Sanitization: No data sanitization or validation steps are documented for the ingested CSV content.
[DYNAMIC_EXECUTION]: The documentation includes examples for model persistence using libraries that perform potentially unsafe deserialization.
Evidence: references/model_evaluation.md provides code examples using joblib.load() and pickle.load() to restore saved models. Deserializing files from untrusted sources can lead to arbitrary code execution. While this is a standard requirement for the library's primary purpose (saving/loading ML models), it represents a dynamic execution risk if the model files are not verified.

scikit-learn