📦

mloda

Name: mloda
Author: mloda-ai

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问

Build Declarative Data Pipelines with mloda

AI agents often generate fragile data-fetching and transformation code. This skill uses mloda feature requests, plugins, and lineage to build deterministic data workflows.

支持: Claude Codex Code(CC)

⚠️ 50 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "mloda" from https://skillstore.io/skills/mloda-ai-mloda.md and its manifest at https://skillstore.io/api/skills/mloda-ai-mloda/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/mloda-ai-mloda.md 已签名 manifest GET /api/skills/mloda-ai-mloda/manifest 已签名 lockfile GET /api/skills/mloda-ai-mloda/lockfile

测试它

正在使用“mloda”。 Check whether installed plugins can calculate ranked revenue by region.

预期结果:

Registry check: a ranking FeatureGroup is available for Pandas. Review and pin the required community package before use.

正在使用“mloda”。 Plan a retrieval, injection check, and PII redaction workflow.

预期结果:

The workflow needs three FeatureGroups in dependency order. Validate each plugin and authorize the final request before execution.

正在使用“mloda”。 Reduce latency for repeated customer feature requests.

预期结果:

Prepare one reusable execution session, supply request data per run, and measure planning and execution latency separately.

安全审计

中风险

v2 • 2026/9/1 打开版本化报告

Most static alerts are false positives caused by Markdown backticks, fences, identifiers, and documentation URLs. Unpinned package installs and direct execution of model-generated feature requests create real supply-chain and authorization risks. No prompt injection or covert exfiltration behavior was found.

已扫描文件

130

分析行数

复核项

已忽略误报

已确认安全问题 (2)

中

SKILL.md:74-94

Unvalidated Model-Generated Feature Execution

The example converts model-produced JSON directly into features and executes them without an allowlist, option validation, authorization, or data-access policy.

The documented flow directly passes parsed model output to mloda.run_all. The example shows no validation boundary before installed plugins receive the request.

中

SKILL.md:128

Additional Unpinned Package Installation

The reference section repeats an unpinned pip installation command without version, hash, trusted-index, or confirmation guidance.

The line explicitly instructs installation of the latest resolved package. Package installation can execute third-party code and produce non-reproducible environments.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

SKILL.md:21

Ruby/shell backtick execution

plain `pip install mloda`; install what you need, e.g. `pip install mloda-community` (all) or

The line explicitly recommends unpinned pip installation commands. Following them downloads and executes third-party package installation code without version or integrity controls.

中

SKILL.md:22

Ruby/shell backtick execution

`pip install "mloda-community-rank[pandas]"` (one). See its

The line provides an unpinned pip command with optional package extras. Installation can execute third-party code and resolve changing dependencies without integrity verification.

风险因素

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/mloda-ai-mloda/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg)](https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/mloda-ai-mloda.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

mloda-ai. (2026). mloda security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mloda-ai-mloda/audits/2

BibTeX 引用

@techreport{mloda-ai-mloda-ai-mloda-2026,
  author = {mloda-ai},
  title = {mloda security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/mloda-ai-mloda/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mloda security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "mloda-ai"
date-released: "2026-09-01"
url: "https://skillstore.io/skills/mloda-ai-mloda/audits/2"
identifiers:
  - type: other
    value: "skillstore:mloda-ai-mloda:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Reuse Existing Transformations

Inspect installed plugins before implementing aggregation, ranking, time-series, or string transformations.

Build Agent Data Tools

Translate constrained model requests into deterministic feature computations with source lineage.

Optimize Repeated Workloads

Prepare execution plans once and reuse them for serving, streaming, or dashboard requests.

试试这些提示

Inspect Available Plugins

Inspect the installed mloda plugins for [feature need]. List matching FeatureGroups, required packages, supported frameworks, and missing capabilities before proposing code.

Plan a Feature Request

Create a mloda request for [features] using [input source]. Use [framework], explain dependencies, and include lineage checks.

Design a RAG Chain

Design a feature-name chain for [RAG workflow]. Map each stage to an existing plugin, identify unavailable stages, and define validation boundaries.

Harden a Reusable Session

Design a reusable mloda session for [workload]. Add a strict feature allowlist, option validation, data-access boundaries, lineage verification, and latency measurements.

最佳实践

Inspect installed plugin documentation before writing custom transformations.
Pin and review packages before installation in production.
Validate model-generated feature names and options against an explicit allowlist.

避免

Do not assume registry documentation matches the current environment.
Do not execute unrestricted model-generated requests against sensitive data.
Do not rebuild execution plans for every repeated request when prepare can reuse them.

常见问题

What is mloda?

mloda is a Python plugin framework that resolves named feature requests into executable data workflows with lineage.

Does this skill install packages automatically?

No. It provides installation guidance, but package selection and installation require review in your environment.

Can it create a missing plugin?

No. This skill identifies missing coverage and directs plugin creation to separate mloda-plugins guidance.

Which compute frameworks are supported?

Examples include PandasDataFrame, PyArrowTable, and PythonDictFramework. Actual availability depends on installed plugins.

How does lineage work?

mloda records dependencies from requested features through their source data and transformation chain.

Is model-generated configuration safe to execute directly?

No. Validate feature names and options, restrict data access, and authorize requests before execution.

开发者详情

作者

mloda-ai

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/mloda-ai/mloda-skills/tree/1cf29f075e7828973a6f86c6238299588c37c5ab/skills/mloda

引用

0acc95b40c367e2016e824a72b27b83b507ef020

维护新鲜度

2026/9/8

使用量

1 次下载 · 0 次浏览

文件结构

📄 SKILL.md