Ml Experiment Tracker

Plan reproducible ML experiment runs with explicit parameters, metrics, and artifacts. Use before model training to standardize tracking-ready experiment def...

This skill appears coherent and low-risk: it only generates experiment plans and writes them to a user-specified output path. Before running, (1) choose a safe output path to avoid overwriting important files, (2) inspect the included script if you have concerns — it's short and uses only standard libraries, (3) if you plan to integrate the plan with an external tracker (e.g., MLflow), provide credentials to that tracker separately and review any integration code before giving secrets, and (4) run the script in a sandbox or CI environment if you are running untrusted inputs. Overall, no unrelated credentials or network calls are requested by the skill.

Type: OpenClaw Skill Name: ml-experiment-tracker Version: 0.1.0 The `scripts/build_experiment_plan.py` script allows arbitrary file read via the `--input` argument and arbitrary file write via the `--output` argument. While the script itself does not exhibit malicious intent, these capabilities, when exposed to an AI agent, create a significant vulnerability for Local File Inclusion/Disclosure and arbitrary file write through prompt injection. A malicious prompt could instruct the agent to read sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) or write to critical system locations, leading to potential data exfiltration or system compromise. This is classified as suspicious due to the presence of a critical vulnerability that could be exploited by a malicious agent prompt.