The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates a Materialization script by substituting variables into a local template (templates/materialize.py) and executes it using the project's Python environment. Additionally, it uses a custom cell runner (skore_skills cells run) described in references/runner_internals.md that executes Python code cells in an InteractiveShell environment to process report data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external skore reports which could potentially be controlled by an attacker if the reports were generated from untrusted data sources. Malicious instructions could be embedded in checks, metrics, or display metadata, which are then rendered into the audit digest and read by the agent.
Ingestion points: skore.Project(...) and project.get(REPORT_ID) calls in SKILL.md and templates/materialize.py.
Boundary markers: The instructions specify a "Read-only contract" and use markdown headers, but do not specify robust sanitization of the content before it enters the agent's context.
Capability inventory: The skill has the ability to write to the scratch/ directory, execute shell commands, and run arbitrary Python code via the cell runner.
Sanitization: The cell runner captures the repr() of execution results, but there is no specific filtering for prompt injection patterns in the report data.
[COMMAND_EXECUTION]: The skill directs the agent to execute several shell commands, including python for materialization, ruff for code styling, and ipython for feature verification. These are used for the primary task of report generation and auditing.

audit-ml-pipeline