Nccl Optimizer

Detect the optimal NCCL configuration for distributed GPU training on this machine. Checks GPU topology (NVLink/PCIe), whether RDMA (InfiniBand / RoCE) is av...

This skill appears to do what it says: run local GPU/topology/RDMA checks and nccl-tests benchmarks. Before running: ensure you're on Linux with NVIDIA drivers and that you trust the machine (the skill executes shell commands and may run heavy GPU/network benchmarks). If you provide nodes for inter-node benchmarking, the skill expects passwordless SSH and will run mpirun across those hosts — only supply node addresses you control. Building nccl-tests clones from GitHub (expected). Be aware that the tool runs binaries with shell invocation (subprocess with shell=True) and will execute any binaries it finds (e.g., all_reduce_perf), so avoid running untrusted inputs to the skill and review the commands it will run if you have security concerns.

Type: OpenClaw Skill Name: nccl-optimizer Version: 1.1.0 The skill is designed for NCCL performance tuning but contains a critical command injection vulnerability. In `__init__.py`, the `_parse_nodes` function extracts hostnames/IPs from user-provided input, which are then concatenated into a command string and executed via `subprocess.check_output(shell=True)` in `_run_internode_allreduce`. While the behavior aligns with the stated purpose of benchmarking distributed GPU clusters, the lack of input sanitization allows an attacker to execute arbitrary shell commands by providing a malicious 'nodes' parameter.