The Agent Skills Directory

[DYNAMIC_EXECUTION]: The Machine Learning strategy templates (ml_logistic and ml_xgb) utilize the pickle module to deserialize pre-trained model files from the local file system. pickle.load() is inherently insecure as it can execute arbitrary code embedded within the data. While these files are meant to be produced by the associated training scripts, loading a maliciously crafted .pkl file could lead to full system compromise.
Evidence: rules/assets/ml_xgb/strategy.py calls pickle.load() on model files.
Evidence: rules/assets/ml_logistic/strategy.py calls pickle.load() on model files.
[DYNAMIC_EXECUTION]: The core utility strategy_loader.py uses the importlib library to dynamically import and execute Python files as modules. This pattern allows for the execution of arbitrary Python code based on provided file paths.
Evidence: rules/assets/core/strategy_loader.py uses importlib.util.spec_from_file_location and exec_module to load strategies.
[COMMAND_EXECUTION]: The portfolio_runner.py supervisor launches multiple strategy instances as child processes using subprocess.Popen. This facilitates the execution of external scripts defined in configuration files.
Evidence: rules/assets/core/portfolio_runner.py invokes subprocess.Popen to start child strategy processes.

algo-expert