MLOps Industrialization

Transform prototypes into distributable Python packages

This skill appears to do exactly what it says: create a three-layer Python package layout. Before running the script, review and run it in a safe/empty directory (or container) because it will create files and directories in your working tree. Avoid passing package names containing path traversal sequences (e.g., '..' or leading slashes) — the script only replaces '-' with '_' and does not sanitize other characters. Expect to install runtime dependencies yourself (pandas, pydantic, parquet engine like pyarrow) and note the small bug in application/train.py (config.model_dump() passed into transform_features) which you may need to fix. If you want additional safety, run the script in a disposable environment or inspect/modify it to validate/sanitize the PACKAGE_NAME before use.

Type: OpenClaw Skill Name: mlops-industrialization-cn Version: 1.0.0 The skill bundle's primary purpose is benign, generating a Python package structure. However, the `scripts/create-package.sh` file contains a shell injection vulnerability. The script uses the user-provided `PACKAGE_NAME` argument directly in `mkdir` commands without proper sanitization. This allows an attacker to inject arbitrary shell commands by crafting a malicious package name (e.g., `my_package; rm -rf /`), leading to potential Remote Code Execution (RCE) if the OpenClaw agent or user provides unsanitized input.