The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill documentation and examples (in SKILL.md, references/deployment.md, and references/model-registry.md) frequently demonstrate the use of mlflow.pyfunc.load_model to retrieve machine learning models. Because MLflow often uses serialization formats like pickle or cloudpickle for its model flavors, loading a model from an untrusted source—such as a specific, unverified run ID or registry path—can lead to arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external data through its tracking and serving functionalities, creating a risk of indirect prompt injection.
Ingestion points: Data enters the system via mlflow.log_param, mlflow.log_artifact, and mlflow.pyfunc.load_model as detailed in SKILL.md and references/tracking.md.
Boundary markers: There are no explicit delimiters or safety instructions provided to the agent to treat this ingested data as untrusted.
Capability inventory: The skill possesses network capabilities for contacting tracking servers and serving models, as well as file system write access for logging artifacts.
Sanitization: No sanitization or validation of the input data is described before it is logged or processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several high-privilege shell commands for installation and infrastructure management, including pip install, docker run, and kubectl apply, which can interact directly with the host environment and network resources.

mlflow