The Agent Skills Directory

[DATA_EXFILTRATION]: The MLEngine class in ml_engine.py includes a model registry system that facilitates saving and loading models. The methods save_to_registry and load_from_registry use namespace and model_id parameters to build filesystem paths. Because these parameters are not sanitized to prevent path traversal characters (such as ../), they could be exploited to access, expose, or overwrite files outside the intended data directories.
[DYNAMIC_EXECUTION]: The MLEngine and ModelPredictor classes in ml_engine.py call PyCaret's load_model function to restore trained states. PyCaret typically utilizes the pickle serialization format, which is insecure when loading data from untrusted sources. A maliciously crafted model file could execute arbitrary commands on the system when it is loaded by the skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests large datasets and generates metadata files in JSON format, creating a surface for indirect prompt injection. If the data being processed or the metadata being saved is influenced by an untrusted source, it could contain instructions designed to manipulate the agent's behavior in later steps of a workflow.
Ingestion points: Training dataframes passed to MLEngine.setup_and_train and factor data in MLFactorEngine (ml_factor.py).
Boundary markers: None; the skill assumes the integrity of the dataframes it receives for processing.
Capability inventory: Filesystem read and write capabilities via the model registry methods in ml_engine.py.
Sanitization: No validation or sanitization is performed on the data content or the metadata fields before they are serialized to the filesystem.

ml