Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent ML engineering playbook with templates and checklists, not a skill that secretly runs code or accesses sensitive data.
This skill appears safe to install as a reference playbook. Users should still review any generated deployment, monitoring, or retraining configuration before applying it to real infrastructure, especially because some invocation phrases are broad and may need clarification in mixed-skill environments.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
COPY src/ ./src/
# Non-root user
RUN useradd -m appuser && chown -R appuser /app
USER appuser
# Health check
The README presents "Deploy model" as a standalone invocation phrase, but it is generic and likely to overlap with common requests in many contexts. The description does not provide trigger constraints, activation boundaries, or negative examples to clarify when this skill should activate versus other deployment-related skills.
"Set up monitoring" is a broad phrase that could refer to infrastructure, application, security, or ML monitoring, making accidental invocation more likely. The README does not define explicit trigger scope or exclusions to distinguish this skill from other monitoring-related skills.
The skill defines very broad natural-language trigger phrases such as "Select model", "Evaluate model", and "Deploy model" without any namespacing or disambiguation. In an agent environment, these generic phrases can be invoked accidentally by ordinary user requests or collide with other skills, causing unintended execution and making prompt-routing easier to manipulate.
No suspicious patterns detected.