The Agent Skills Directory

[DYNAMIC_EXECUTION]: The documentation in references/workflows.md mentions the use of the pickle module for serializing models. While pickle.load() is a known insecure deserialization vector when used with untrusted files, the skill prominently features and recommends the safer arviz.to_netcdf() method for data persistence. This is identified as a best-practice violation in the documentation rather than a vulnerability in the skill's logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided datasets (X, y arrays) for statistical inference. This data ingestion is a theoretical surface for indirect prompt injection; however, the skill's execution environment is restricted to mathematical operations and local report generation, and it lacks the network or system-level capabilities required to exploit such an injection.
[SAFE]: No remote code execution, unauthorized network access, or sensitive data harvesting was detected. The scripts and templates operate entirely within the expected domain of probabilistic programming.

pymc-bayesian-modeling