The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses pickle.load(), joblib.load(), and torch.load() to deserialize models and training artifacts. These methods are inherently unsafe when used with untrusted data, as they can execute arbitrary code during the loading process.
Evidence in references/training-pipelines.md: torch.load(checkpoint_path / "checkpoint.pt", ...)
Evidence in references/pipeline-orchestration.md: joblib.load(model_artifact.path)
Evidence in references/feature-engineering.md: pickle.load(f) in the FeaturePipeline.load method.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from various sources (local files, S3, GCS) for training and feature engineering. While typical for ML workflows, this creates an attack surface where maliciously crafted data files could potentially influence the agent's behavior if instructions were embedded within the data.
Ingestion points: The data_path parameter in ml_pipeline (references/pipeline-orchestration.md) and various load_data tasks serve as entry points for untrusted data.
Boundary markers: The skill does not implement specific delimiters or instructions to ignore potential commands embedded within data files.
Capability inventory: The skill templates utilize file system writes, subprocess execution (via containerized orchestration components), and network operations to interact with cloud storage (S3, GCS).
Sanitization: Data is validated for schema and statistical distribution using great_expectations, but there is no sanitization of content against adversarial prompts or embedded instructions.

ml-pipeline