Agent Ai Ml Ops Specialist

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This MLOps skill is mostly coherent, but it should be reviewed because it tells the agent to read and apply an unbundled local skill file that was not part of this package review.

Review this before installing. It appears intended for legitimate MLOps help, but it is not self-contained: it relies on another local skill file whose contents can change outside this package. Only use it if you trust that local file and understand that the included example commands may affect services, feature-store state, or network exposure if run directly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:21

Finding

Mutable External Skill File Can Hijack Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 21 and lines 66–69
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippets:

md

**Skill Reference**: `~/.claude/skills/ai-ml-ops/SKILL.md` - Detailed patterns, code examples, best practices.

md

1. **Read skill file**: `~/.claude/skills/ai-ml-ops/SKILL.md`
2. **Identify domain** (CV, NLP, fraud, etc.)
3. **Assess lifecycle stage** (training, deployment, monitoring)
4. **Apply patterns** from skill file

Technical Analysis

The packaged Skill delegates part of its operative behavior to ~/.claude/skills/ai-ml-ops/SKILL.md, an external local file that is not included in the audited project. The workflow explicitly requires the agent to read this file and apply its contents as instructional patterns.

Because the external file is mutable and its content cannot be verified from this package, a party with write access to that path could add instructions that alter the agent's goals, weaken safety constraints, misuse available tools, or direct unrelated actions. Such modifications would change effective Skill behavior without changing the reviewed SKILL.md or _meta.json.

The documented broad tool inventory increases the potential consequence if those tools are available at runtime, although the inventory itself does not grant permissions. Exploitation requires the attacker or another compromised process to obtain write access to the referenced local file.

Attack Path

1. An attacker obtains write access to ~/.claude/skills/ai-ml-ops/SKILL.md, such as through a compromised local account, unsafe provisioning process, or another component that writes to the user's Skill directory.
2. The attacker inserts adversarial instructions into that file, directing the agent to ignore its intended MLOps scope or perform unauthorized operations.
3. A user invokes this packaged Skill for an MLOps-related request.
4. The workflow instruct ...[truncated 984 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the referenced MLOps guidance inside the reviewed project rather than loading instructions from a mutable file in the user's home directory.
2. Reference the bundled content through a package-relative path and include it in normal version control, review, and release-integrity checks.
3. If an external file is operationally necessary, verify it against a trusted cryptographic hash or signature before use and fail closed when validation fails.
4. Do not treat unverified external content as authoritative instructions. Parse it as untrusted reference data and prevent it from overriding system policies, safety constraints, tool restrictions, or the user's task.
5. Restrict file ownership and permissions so that only the intended trusted account can modify the external Skill directory and file.
6. Apply least-privilege tool permissions at runtime. Only enable filesystem, shell, network, and write capabilities that are necessary for the current task.
7. Record the validated file identity and version in audit logs so unexpected changes can be detected and investigated.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill when requests 'match this domain or role,' but it does not define boundaries for what constitutes a match. This ambiguity can lead to unintended activation on broad AI/ML topics, increasing the risk of unnecessary tool use, over-scoped behavior, or role confusion within the agent system.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

**Purpose**: Universal ML operations expert for model lifecycle management, deployment, monitoring, and optimization across all ML domains.

**Skill Reference**: `~/.claude/skills/ai-ml-ops/SKILL.md` - Detailed patterns, code examples, best practices.

---

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

**Purpose**: Universal ML operations expert for model lifecycle management, deployment, monitoring, and optimization across all ML domains.

**Skill Reference**: `~/.claude/skills/ai-ml-ops/SKILL.md` - Detailed patterns, code examples, best practices.

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-trigger section is broadly scoped to common ML activities such as model development, deployment, monitoring, and compliance, which can cause the skill to activate for many ordinary requests without clear gating criteria. Overly broad invocation increases the chance that the agent will inappropriately assume this role, follow its workflow, or surface operational guidance in contexts where a narrower or safer skill should be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The quick reference includes operational shell commands that can start services, modify feature store state, or expose network listeners, but it provides no warning that these commands may affect local or connected environments. In an agent setting, embedding runnable commands without safety framing raises the chance of accidental execution or unsafe copy-paste into production-like systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.