The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes instructions for installing the shap library and its dependencies (such as matplotlib, scikit-learn, numpy, and pandas) from official package registries using the uv tool.
[COMMAND_EXECUTION]: The skill provides various Python code snippets for common data science tasks including training models with xgboost, tensorflow, and scikit-learn, as well as generating SHAP values and visualizations. These commands are necessary for the skill's stated purpose.
[REMOTE_CODE_EXECUTION]: The skill uses joblib.load() to restore trained models and explainer objects from local files.
Evidence: Code examples in SKILL.md and references/workflows.md demonstrate loading .pkl files for production deployment.
Analysis: Deserialization using joblib is a standard practice in machine learning for object persistence. While loading untrusted files can be a risk, its use here is consistent with the primary purpose of the skill in a developer context.
[PROMPT_INJECTION]: The skill processes external data inputs and model files provided by the user.
Ingestion points: Data and model files are loaded into the execution environment via pandas.read_csv and joblib.load (located in references/workflows.md).
Boundary markers: Code blocks are delimited using standard Markdown syntax.
Capability inventory: The skill possesses capabilities to execute Python code, read local files, and save visualization outputs to disk.
Sanitization: The instructions do not specify validation or sanitization of input data before processing.
Analysis: This exposure represents an inherent surface for indirect prompt injection through adversarial datasets, which is common for data analysis tooling but remains a low-risk factor in this context.

shap