The Agent Skills Directory

[DYNAMIC_EXECUTION]: The file references/workflows.md provides a code pattern for saving and loading models using Python's pickle library. The pickle.load() function is used, which is an unsafe deserialization method that can lead to arbitrary code execution if a user provides a malicious pickle file. While the documentation includes a warning comment advising users to only unpickle trusted files and suggesting NetCDF as a safer alternative, the inclusion of this code as a standard pattern for an AI agent to use creates a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill includes several templates and reference examples (e.g., assets/linear_regression_template.py, assets/hierarchical_model_template.py, and references/workflows.md) that ingest untrusted external data via pandas.read_csv(). This data is then processed into a pm.Model context and used for sampling and prediction. Because the skill has extensive capabilities—including the Bash tool and model compilation (via pm.sample())—it presents an attack surface where malicious instructions embedded in a CSV file could influence agent behavior or compromise the environment.
Ingestion points: CSV data loading in assets/linear_regression_template.py, assets/hierarchical_model_template.py, and references/workflows.md.
Boundary markers: None identified in the provided templates to isolate or ignore instructions embedded in the data.
Capability inventory: The skill uses Bash, Write, and Edit tools, and performs complex code generation/compilation through the PyMC/PyTensor sampling process.
Sanitization: No sanitization or validation of the ingested CSV content is performed before processing.

pymc