The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Python scripts (convert_mlflow_to_atif.py and load_mlflow_trace.py) designed to be executed via the CLI for processing trace data.
[DYNAMIC_EXECUTION]: The script convert_mlflow_to_atif.py uses importlib.import_module to load the mlflow and harbor libraries. These calls use static string identifiers and are gated by user-provided flags (--tracking-uri or --validate-with-harbor), serving as a mechanism to handle optional dependencies rather than executing untrusted code.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted trace data from MLflow exports which may contain embedded human instructions or LLM outputs. It maps this data into the structured ATIF format without executing the content. The script includes logic to fail if human instructions are missing rather than inventing them, reducing the risk of processing malformed or malicious inputs.
[SAFE]: The skill implements significant security hardening, including a transport validation function (_validate_mlflow_transport) that rejects non-loopback HTTP connections and respects MLFLOW_TRACKING_INSECURE_TLS settings to prevent credential leakage. Additionally, it ensures output directories and files are created with restrictive permissions (0700/0600).

mlflow-to-atif