mlflow-trace-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a bundled Python script (
scripts/fetch_metrics.py) to query the MLflow API. - The script uses standard libraries (
urllib.request) to perform POST requests to a tracking server URL provided by the user via the-s/--serverflag. - The execution is constrained to fetching metrics and does not involve arbitrary shell command injection or privilege escalation.
- [DATA_EXFILTRATION]: While the script sends data to a remote server, the server URL is a required user-provided parameter, and the instructions explicitly warn against requesting or pasting authentication tokens into the skill's environment.
- The skill documentation advises users to use existing authenticated clients and specifically forbids converting Databricks profiles to workspace URLs, which helps prevent accidental credential exposure.
Audit Metadata