The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from project-specific files such as exploratory data analysis (EDA) reports, backlog items, and journal notes. This represents a potential surface for indirect prompt injection if these files are sourced from untrusted contributors. However, the risk is effectively mitigated by the skill's design, which requires explicit human-in-the-loop (HITL) approval (Approve / Modify / Stop) at every critical juncture before code is generated or executed.
Ingestion points: Reads data_analysis/data_analysis.md, journal/*.md, and project goals.
Boundary markers: The skill instructions emphasize quoting facts inline for human review, which serves as a natural boundary.
Capability inventory: The skill can load other internal skills, execute CLI commands, and write to project files.
Sanitization: Content is echoed back to the user for validation before being acted upon.
[SAFE]: The deterministic entry routing and status checks (e.g., skore_skills status) ensure the agent remains within the bounds of the project state and prevents the execution of unauthorized or premature actions.
[SAFE]: Instructions that limit the agent's prose (e.g., 'not skill ids, G-* names') are stylistic constraints intended to maintain a consistent data-science terminology for the user, rather than malicious attempts to conceal functionality or intent from the user. This is a common design pattern for developer-focused tools.
[SAFE]: The skill recommends the use of standard, well-known libraries such as jupytext, nbconvert, and mkdocs-material for reporting and site building, which is appropriate for its stated purpose.

model-ml-pipeline