📦

mloda

Name: mloda
Author: mloda-ai

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды🌐 Доступ к сети

Build Declarative Data Pipelines with mloda

AI agents often generate fragile data-fetching and transformation code. This skill uses mloda feature requests, plugins, and lineage to build deterministic data workflows.

Поддерживает: Claude Codex Code(CC)

⚠️ 50 Плохо

Maintain this Skill? Claim it ⚠️ 50 Плохо

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "mloda" from https://skillstore.io/skills/mloda-ai-mloda.md and its manifest at https://skillstore.io/api/skills/mloda-ai-mloda/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/mloda-ai-mloda.md Подписанный manifest GET /api/skills/mloda-ai-mloda/manifest Подписанный lockfile GET /api/skills/mloda-ai-mloda/lockfile

Протестировать

Использование «mloda». Check whether installed plugins can calculate ranked revenue by region.

Ожидаемый результат:

Registry check: a ranking FeatureGroup is available for Pandas. Review and pin the required community package before use.

Использование «mloda». Plan a retrieval, injection check, and PII redaction workflow.

Ожидаемый результат:

The workflow needs three FeatureGroups in dependency order. Validate each plugin and authorize the final request before execution.

Использование «mloda». Reduce latency for repeated customer feature requests.

Ожидаемый результат:

Prepare one reusable execution session, supply request data per run, and measure planning and execution latency separately.

Аудит безопасности

Средний риск

v2 • 01.09.2026 Открыть версионный отчет

Most static alerts are false positives caused by Markdown backticks, fences, identifiers, and documentation URLs. Unpinned package installs and direct execution of model-generated feature requests create real supply-chain and authorization risks. No prompt injection or covert exfiltration behavior was found.

Просканировано файлов

130

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Средний

SKILL.md:74-94

Unvalidated Model-Generated Feature Execution

The example converts model-produced JSON directly into features and executes them without an allowlist, option validation, authorization, or data-access policy.

The documented flow directly passes parsed model output to mloda.run_all. The example shows no validation boundary before installed plugins receive the request.

Средний

SKILL.md:128

Additional Unpinned Package Installation

The reference section repeats an unpinned pip installation command without version, hash, trusted-index, or confirmation guidance.

The line explicitly instructs installation of the latest resolved package. Package installation can execute third-party code and produce non-reproducible environments.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

SKILL.md:21

Ruby/shell backtick execution

plain `pip install mloda`; install what you need, e.g. `pip install mloda-community` (all) or

The line explicitly recommends unpinned pip installation commands. Following them downloads and executes third-party package installation code without version or integrity controls.

Средний

SKILL.md:22

Ruby/shell backtick execution

`pip install "mloda-community-rank[pandas]"` (one). See its

The line provides an unpinned pip command with optional package extras. Installation can execute third-party code and resolve changing dependencies without integrity verification.

Факторы риска

⚙️ Внешние команды (21)

🌐 Доступ к сети (5)

SKILL.md:4 SKILL.md:23 SKILL.md:99 SKILL.md:127 SKILL.md:129

Аудитор:: codex Посмотреть историю аудитов →

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/mloda-ai-mloda/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg)](https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/mloda-ai-mloda.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

mloda-ai. (2026). mloda security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mloda-ai-mloda/audits/2

Цитата BibTeX

@techreport{mloda-ai-mloda-ai-mloda-2026,
  author = {mloda-ai},
  title = {mloda security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/mloda-ai-mloda/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mloda security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "mloda-ai"
date-released: "2026-09-01"
url: "https://skillstore.io/skills/mloda-ai-mloda/audits/2"
identifiers:
  - type: other
    value: "skillstore:mloda-ai-mloda:audit:2"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Reuse Existing Transformations

Inspect installed plugins before implementing aggregation, ranking, time-series, or string transformations.

Build Agent Data Tools

Translate constrained model requests into deterministic feature computations with source lineage.

Optimize Repeated Workloads

Prepare execution plans once and reuse them for serving, streaming, or dashboard requests.

Попробуйте эти промпты

Inspect Available Plugins

Inspect the installed mloda plugins for [feature need]. List matching FeatureGroups, required packages, supported frameworks, and missing capabilities before proposing code.

Plan a Feature Request

Create a mloda request for [features] using [input source]. Use [framework], explain dependencies, and include lineage checks.

Design a RAG Chain

Design a feature-name chain for [RAG workflow]. Map each stage to an existing plugin, identify unavailable stages, and define validation boundaries.

Harden a Reusable Session

Design a reusable mloda session for [workload]. Add a strict feature allowlist, option validation, data-access boundaries, lineage verification, and latency measurements.

Лучшие практики

Inspect installed plugin documentation before writing custom transformations.
Pin and review packages before installation in production.
Validate model-generated feature names and options against an explicit allowlist.

Избегать

Do not assume registry documentation matches the current environment.
Do not execute unrestricted model-generated requests against sensitive data.
Do not rebuild execution plans for every repeated request when prepare can reuse them.

Часто задаваемые вопросы

What is mloda?

mloda is a Python plugin framework that resolves named feature requests into executable data workflows with lineage.

Does this skill install packages automatically?

No. It provides installation guidance, but package selection and installation require review in your environment.

Can it create a missing plugin?

No. This skill identifies missing coverage and directs plugin creation to separate mloda-plugins guidance.

Which compute frameworks are supported?

Examples include PandasDataFrame, PyArrowTable, and PythonDictFramework. Actual availability depends on installed plugins.

How does lineage work?

mloda records dependencies from requested features through their source data and transformation chain.

Is model-generated configuration safe to execute directly?

No. Validate feature names and options, restrict data access, and authorize requests before execution.

Сведения для разработчиков

Автор

mloda-ai

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/mloda-ai/mloda-skills/tree/1cf29f075e7828973a6f86c6238299588c37c5ab/skills/mloda

Ссылка

0acc95b40c367e2016e824a72b27b83b507ef020

Актуальность поддержки

08.09.2026

Использование

1 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md