Security checks across malware telemetry and agentic risk
This ML skill is mostly coherent, but it can automatically run remotely generated Python code locally and use an OpenAI key without enough user control or safety boundaries.
Install only in an isolated environment or container, avoid sensitive datasets, and unset OPENAI_API_KEY unless you intentionally want OpenAI calls. Treat generated code as untrusted and review it before relying on results; clean up temporary CSV files after using the Streamlit upload flow.
namespace: Dict[str, Any] = {}
try:
exec(code, namespace) # noqa: S102
train_fn = namespace.get("train_and_evaluate")
if not callable(train_fn):
raise ValueError("生成代码中未定义 train_and_evaluate 函数。")66/66 vendors flagged this skill as clean.