The Agent Skills Directory

[SAFE]: No malicious patterns detected. The skill follows best practices for AI agent extensions by implementing clear boundaries, user confirmation steps, and static analysis of user input before performing potentially sensitive operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user source code as part of the conversion process. However, it mitigates this risk by emphasizing static inspection (nvflare agent inspect source) to extract facts without execution, employing explicit recipe construction from known templates, and providing clear instructions to fail closed or ask the user when code intent is ambiguous. It also includes specific sanitization warnings against using insecure pickle loading for repo-supplied checkpoints (documented in references/lightning-conversion.md).
[COMMAND_EXECUTION]: The skill generates and runs Python scripts (job.py) and uses the nvflare CLI. These operations are standard for the tool's purpose and are conducted within the host-supplied environment. The instructions explicitly direct the agent to respect the host's security boundaries and permission mechanisms.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of necessary Python packages (e.g., pytorch-lightning, nvflare). It implements a secure workflow by requiring the agent to audit dependencies, present a redacted installation plan, and obtain explicit user confirmation before proceeding with any package installation.

nvflare-convert-lightning