The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides code templates for production deployment and model loading that utilize joblib.load(), torch.load(), and tf.keras.models.load_model(). These functions are known to be vulnerable to arbitrary code execution (deserialization attacks) if the loaded file is malicious or originates from an untrusted source.
Evidence: joblib.load('explainer.pkl') in SKILL.md and references/workflows.md.
Evidence: torch.load('model.pt') in references/explainers.md.
Evidence: tf.keras.models.load_model('my_model.h5') in references/explainers.md and references/workflows.md.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external datasets (e.g., X_test) to compute feature attributions and generate visualizations. This ingestion of untrusted data represents an attack surface for indirect prompt injection if the data contains malicious instructions intended to influence the agent's behavior during analysis or report generation.
Ingestion points: shap_values = explainer(X_test) in SKILL.md and throughout reference files.
Boundary markers: None present in the provided templates.
Capability inventory: Python execution, model loading via joblib/torch, and package installation capabilities.
Sanitization: No explicit data validation or sanitization steps are included in the provided workflows.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructions include commands to install the shap and matplotlib packages via uv pip. These are standard packages from the official Python Package Index (PyPI) and are considered safe under the trust-scope rule for well-known services.
Evidence: uv pip install shap matplotlib in SKILL.md.

shap