自动化生成工业级机器学习分类算法代码、调用算法做预测、输出准确率对比和可视化结果，支持新手友好的结果解读。

What to consider before installing or running this skill: - The skill can optionally use your OpenAI key to generate Python training functions (Codex) and to create natural-language interpretations. That key is sensitive; the manifest did not declare it. Expect prompts and possibly dataset metadata to be sent to OpenAI if you provide the key. - The skill may execute Python code returned by the LLM. Generated code can be arbitrary and could read files, open network connections, or exfiltrate data. If you plan to run it, do so only in an isolated environment (container or VM) and with non-sensitive example data until you audit the generated code. - If you do not want any data leaving your environment, do NOT provide an OpenAI key and do not enable features that call external LLMs; instead let the skill fall back to its bundled local templates (the code indicates it has local templates as a fallback). - Before trusting results: inspect the generated code (the UI exposes generated_codes) and verify it only uses sklearn/XGBoost/LightGBM and does not perform I/O or network calls you don't expect. - Prefer running the demo in a disposable virtualenv/VM, review requirements.txt before pip installing, and avoid running with production or sensitive datasets unless you have audited the runtime behavior and are comfortable with the LLM calls. Confidence is medium because parts of advanced_ml_skill.py were truncated in the provided listing; reviewing the complete run()/code-generation/execution implementation would reduce uncertainty.

Type: OpenClaw Skill Name: advanced-ml-classification-skill Version: 1.0.0 The skill bundle implements an automated machine learning pipeline that dynamically generates and executes Python code using an LLM (Codex) via the `exec()` function in `advanced_ml_skill.py`. While this aligns with the stated goal of 'automated code generation,' it introduces a critical Remote Code Execution (RCE) vulnerability, as the agent executes unvalidated code produced by an external model. There is no evidence of intentional malice, data exfiltration, or backdoors, but the architectural reliance on executing untrusted generated strings makes the bundle high-risk.