machine-learning-ops-ml-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a template-based orchestration approach where untrusted user input from the
$ARGUMENTSvariable is directly interpolated into the prompts for seven distinct sub-agents (data-engineer, data-scientist, ml-engineer, python-pro, mlops-engineer, kubernetes-architect, and observability-engineer). - Ingestion points: The
$ARGUMENTSvariable is used as the primary requirement source in almost every phase defined inSKILL.md. - Boundary markers: The prompt templates lack delimiters (such as XML tags or triple quotes) or specific instructions to the sub-agents to ignore potentially malicious commands embedded within the user input.
- Capability inventory: The orchestration chain is highly capable, instructing sub-agents to generate production Python code, Terraform modules, Helm charts, Kubernetes manifests, and CI/CD pipeline configurations (GitHub Actions/GitLab CI).
- Sanitization: There is no evidence of input validation, escaping, or sanitization before the user-provided requirements are used to drive code generation.
- [DYNAMIC_EXECUTION]: The skill's primary function is to generate executable scripts and infrastructure-as-code (IaC) configurations based on natural language requirements.
- Evidence: Phase 2 and Phase 3 instructions explicitly ask sub-agents to provide 'complete training code,' 'production-ready, maintainable code,' and 'complete deployment configuration and automation scripts.'
- Risk: While this is the intended purpose of the MLOps skill, the lack of input boundaries makes it possible for a crafted input to influence the generated code's logic (e.g., adding a backdoor to a generated Dockerfile or Terraform module).
Audit Metadata