MLOps Validation CN

Rigorous validation with typing, linting, testing, and security

This skill appears to do what it says (adds pre-commit hooks and pytest fixtures) but there are a few practical and safety checks you should do before using it: - Review the files before copying: the commands in SKILL.md call cp to overwrite .pre-commit-config.yaml and tests/conftest.py in your project — back up any existing files first. - Check required tools and libraries: the SKILL.md assumes you have pre-commit, pytest, ruff, mypy, bandit installed and your project has pandas, numpy, and scikit-learn for the fixtures; the package metadata does not list these prerequisites. Install them in a virtualenv or test environment first. - Inspect the pre-commit config: pre-commit will fetch and execute hooks from remote GitHub repos. The config uses pinned revisions from well-known projects (ruff, bandit, etc.), which reduces risk, but you should still inspect the hook list and revisions to be comfortable with what will run on each commit. - Test in isolation: try the copy/install/run steps in a throwaway branch or sandbox repository so you can confirm nothing is unexpectedly overwritten or fails. If you want me to, I can (1) list the exact packages/commands you'll need to install to run the skill successfully, (2) show a diff of what copying the two files would change against a provided repository, or (3) check the referenced pre-commit repo revisions for known issues.

Type: OpenClaw Skill Name: mlops-validation-cn Version: 1.0.0 The OpenClaw AgentSkills bundle 'mlops-validation-cn' is benign. It provides instructions and configuration for setting up MLOps validation tools like Ruff, MyPy, Bandit, and Pytest. The SKILL.md contains standard shell commands for copying configuration files and installing/running pre-commit hooks and testing frameworks, all operating locally within the user's project. The `references/conftest.py` and `references/pre-commit-config.yaml` files contain legitimate Python test fixtures and configurations for well-known code quality and security tools, respectively. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the AI agent for harmful purposes.