Agent skill · security · yaklang
ai-ml-security
AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.
Why this skill is useful
Provides detailed attack vectors and mitigation strategies for AI/ML security that are not widely known or documented.
What it needs
About 9k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: AI/ML Security — Expert Attack Playbook AI LOAD INSTRUCTION: Expert AI/ML security techniques. Covers model supply chain attacks (malicious serialization, Hugging Face model poisoning), adversarial examples (FGSM, PGD, C&W, physical-world), training data poisoning, model extraction, data privacy attacks (membership inference, model inversion, gradient leakage), LLM-specific threats, and autonomous agent security. Base models underestimate the severity of pickle deserialization RCE and the practicality of black-box model extraction. 0. RELATED ROUTING llm-prompt-injection for LLM-specific prompt injection, jailbreaking, and tool abuse techniques deserialization-insecure for deeper coverage of Python pickle and general deserialization attack patterns dependency-confusion when the ML pipeline has supply chain risks via pip/npm package confusion --- 1. MODEL SUPPLY CHAIN ATTACKS 1.1 Malicious Model Files — Pickle RCE Python's pickle module executes arbitrary code during deserialization. PyTorch .pt/.pth files use pickle by default. Loading torch.load('model.pt') executes the embedded command. Applies to: Format Risk Mitigation --- --- --- .pt / .pth (PyTorch) Critical — pickle by default Use torch.load(..., weightsonly=True) (PyTorch ≥ 2.0) .pkl / .pickle Critical — raw pickle Never load untrusted pickles .joblib High — uses pickle internally Verify provenance .npy / .npz (NumPy) Medium — allowpickle=True enables RCE Use allowpickle=False .safetensors Safe — tensor-only format, no code execution Preferred format .onnx Safe — graph definition only, no arbitrary code Preferred for inference 1.2 Hugging Face Model Poisoning Detection signals: Files with .pt/.pkl extension instead of .safetensors Custom Python code in the repository (.py files outside standard config) Unusual config.json with trustremotecode=True requirement Model card lacking provenance, training data description, or eval results 1.3 Dependency Confusion in ML Pipelines ML projects often have comple …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/ai-ml-security