📦

mloda

Name: mloda
Author: mloda-ai

內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取

Build Declarative Data Pipelines with mloda

AI agents often generate fragile data-fetching and transformation code. This skill uses mloda feature requests, plugins, and lineage to build deterministic data workflows.

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "mloda" from https://skillstore.io/skills/mloda-ai-mloda.md and its manifest at https://skillstore.io/api/skills/mloda-ai-mloda/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/mloda-ai-mloda.md 已簽名 manifest GET /api/skills/mloda-ai-mloda/manifest 已簽名 lockfile GET /api/skills/mloda-ai-mloda/lockfile

測試它

正在使用「mloda」。 Check whether installed plugins can calculate ranked revenue by region.

預期結果:

Registry check: a ranking FeatureGroup is available for Pandas. Review and pin the required community package before use.

正在使用「mloda」。 Plan a retrieval, injection check, and PII redaction workflow.

預期結果:

The workflow needs three FeatureGroups in dependency order. Validate each plugin and authorize the final request before execution.

正在使用「mloda」。 Reduce latency for repeated customer feature requests.

預期結果:

Prepare one reusable execution session, supply request data per run, and measure planning and execution latency separately.

安全審計

中風險

v2 • 2026/9/1 開啟版本化報告

Most static alerts are false positives caused by Markdown backticks, fences, identifiers, and documentation URLs. Unpinned package installs and direct execution of model-generated feature requests create real supply-chain and authorization risks. No prompt injection or covert exfiltration behavior was found.

已掃描檔案

130

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

中

SKILL.md:74-94

Unvalidated Model-Generated Feature Execution

The example converts model-produced JSON directly into features and executes them without an allowlist, option validation, authorization, or data-access policy.

The documented flow directly passes parsed model output to mloda.run_all. The example shows no validation boundary before installed plugins receive the request.

中

SKILL.md:128

Additional Unpinned Package Installation

The reference section repeats an unpinned pip installation command without version, hash, trusted-index, or confirmation guidance.

The line explicitly instructs installation of the latest resolved package. Package installation can execute third-party code and produce non-reproducible environments.

能力複核項目 (2)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:21

Ruby/shell backtick execution

plain `pip install mloda`; install what you need, e.g. `pip install mloda-community` (all) or

The line explicitly recommends unpinned pip installation commands. Following them downloads and executes third-party package installation code without version or integrity controls.

中

SKILL.md:22

Ruby/shell backtick execution

`pip install "mloda-community-rank[pandas]"` (one). See its

The line provides an unpinned pip command with optional package extras. Installation can execute third-party code and resolve changing dependencies without integrity verification.

風險因素

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/mloda-ai-mloda/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg)](https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/mloda-ai-mloda?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mloda-ai-mloda/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/mloda-ai-mloda.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

mloda-ai. (2026). mloda security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mloda-ai-mloda/audits/2

BibTeX 引用

@techreport{mloda-ai-mloda-ai-mloda-2026,
  author = {mloda-ai},
  title = {mloda security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/mloda-ai-mloda/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mloda security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "mloda-ai"
date-released: "2026-09-01"
url: "https://skillstore.io/skills/mloda-ai-mloda/audits/2"
identifiers:
  - type: other
    value: "skillstore:mloda-ai-mloda:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Reuse Existing Transformations

Inspect installed plugins before implementing aggregation, ranking, time-series, or string transformations.

Build Agent Data Tools

Translate constrained model requests into deterministic feature computations with source lineage.

Optimize Repeated Workloads

Prepare execution plans once and reuse them for serving, streaming, or dashboard requests.

試試這些提示

Inspect Available Plugins

Inspect the installed mloda plugins for [feature need]. List matching FeatureGroups, required packages, supported frameworks, and missing capabilities before proposing code.

Plan a Feature Request

Create a mloda request for [features] using [input source]. Use [framework], explain dependencies, and include lineage checks.

Design a RAG Chain

Design a feature-name chain for [RAG workflow]. Map each stage to an existing plugin, identify unavailable stages, and define validation boundaries.

Harden a Reusable Session

Design a reusable mloda session for [workload]. Add a strict feature allowlist, option validation, data-access boundaries, lineage verification, and latency measurements.

最佳實務

Inspect installed plugin documentation before writing custom transformations.
Pin and review packages before installation in production.
Validate model-generated feature names and options against an explicit allowlist.

避免

Do not assume registry documentation matches the current environment.
Do not execute unrestricted model-generated requests against sensitive data.
Do not rebuild execution plans for every repeated request when prepare can reuse them.

常見問題

What is mloda?

mloda is a Python plugin framework that resolves named feature requests into executable data workflows with lineage.

Does this skill install packages automatically?

No. It provides installation guidance, but package selection and installation require review in your environment.

Can it create a missing plugin?

No. This skill identifies missing coverage and directs plugin creation to separate mloda-plugins guidance.

Which compute frameworks are supported?

Examples include PandasDataFrame, PyArrowTable, and PythonDictFramework. Actual availability depends on installed plugins.

How does lineage work?

mloda records dependencies from requested features through their source data and transformation chain.

Is model-generated configuration safe to execute directly?

No. Validate feature names and options, restrict data access, and authorize requests before execution.

開發者詳細資訊

作者

mloda-ai

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/mloda-ai/mloda-skills/tree/1cf29f075e7828973a6f86c6238299588c37c5ab/skills/mloda

引用

0acc95b40c367e2016e824a72b27b83b507ef020

維護新鮮度

2026/9/8

使用量

1 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md