tensorpool

This skill helps users migrate their local machine learning scripts to run on TensorPool GPU clusters using the interactive cluster workflow (tp ssh). Use th...

This skill appears to do what it says (migrate scripts to TensorPool), but it instructs the agent to automatically edit, install packages, and re-run your code without asking. Before installing or enabling it: (1) require explicit confirmation before any changes, (2) use a disposable environment (virtualenv/conda or container) and back up your code, (3) be prepared to review all pip installs and code edits, (4) do not expose long-lived API keys/SSH keys unnecessarily — prefer temporary credentials or local authenticated sessions, and (5) monitor cluster creation to avoid unexpected cloud costs. If you need stronger guarantees, ask the skill author to remove the 'fix without asking' directive or to add an explicit opt-in prompt before making changes.

Type: OpenClaw Skill Name: tensorpool Version: 1.0.0 The skill facilitates migrating ML scripts to TensorPool GPU clusters but contains high-risk instructions that grant the AI agent significant autonomy. Specifically, SKILL.md instructs the agent to 'proactively diagnose and fix' errors by executing commands like 'pip install' and 'mkdir' without asking for user permission. It also involves sensitive operations such as generating SSH keys (ssh-keygen) and accessing the ~/.ssh directory. While these actions are aligned with the stated purpose of cloud migration, the lack of human-in-the-loop confirmation for command execution and the handling of environment variables/SSH keys create a significant attack surface for potential exploitation.