mlflow-patterns
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes hardcoded credentials in the PostgreSQL setup example using the password 'secure_password'. While intended as a placeholder, providing hardcoded credentials in patterns labeled for production deployment encourages poor security practices.\n- [REMOTE_CODE_EXECUTION]: Pattern 3 demonstrates executing code directly from a remote Git repository using the
mlflow runcommand (e.g.,https://github.com/org/repo.git). This pattern allows for the download and execution of arbitrary code from potentially untrusted external sources.\n- [DYNAMIC_EXECUTION]: Pattern 4 utilizesjoblib.load()to deserialize model artifacts. Sincejoblibrelies on thepickleprotocol internally, it is vulnerable to arbitrary code execution if a malicious artifact is loaded from a compromised or untrusted artifact store.\n- [EXTERNAL_DOWNLOADS]: The skill suggests downloading and running code from external Git repositories and pulling Docker images from public registries likeghcr.iofor production workloads.\n- [COMMAND_EXECUTION]: The skill provides examples of direct shell command execution for database creation (psql), server management (mlflow server), and training pipeline execution (mlflow run).\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for processing untrusted external data via model artifacts and webhooks.\n - Ingestion points: Artifact loading via
joblib.loadinSKILL.md.\n - Boundary markers: None identified in instructions.\n
- Capability inventory: Shell command execution via
mlflow runand database management viapsqlinSKILL.md.\n - Sanitization: No validation or sanitization of deserialized artifact contents.
Audit Metadata