Build transformer fine-tuning run plans with task settings, hyperparameters, and model-card outputs. Use for repeatable Hugging Face or PyTorch finetuning wo...

This skill appears to do what it says: generate finetuning run plans. Before installing or running it, consider: (1) review the bundled script yourself — it writes files to whatever output path you provide and can overwrite existing files, so avoid privileged/system paths; (2) prefer running with --dry-run first to inspect output without side effects; (3) do not pass secrets or credentials in the optional input JSON; (4) validate any datasets or metrics referenced (license/risk notes are included but not enforced); (5) because the platform allows autonomous invocation, restrict when/where the agent can run this skill if you want to avoid unexpected file writes. Overall the package is coherent and self-contained.

Type: OpenClaw Skill Name: dl-transformer-finetune Version: 0.1.0 The `scripts/build_finetune_plan.py` script takes user-controlled file paths for `--input` and `--output` arguments. This creates a vulnerability for potential arbitrary file read (limited to JSON-parsable files) and arbitrary file write on the local filesystem. While the script's intended purpose is benign (generating fine-tuning plans), this capability could be exploited by a malicious actor manipulating the agent's arguments to access or modify sensitive files. There is no evidence of intentional malicious behavior like data exfiltration or remote code execution within the script or prompt injection attempts in `SKILL.md`.