MLOps Project Initialization

• Verdict: Pass
• Analyzed: May 12, 2026, 4:18 AM
• Findings: 0
• Version: 1.0.0
• Hash: 408fb68843aca861a5ae74fe6ca6cc501625b0ba623fd3e0ae7b8e78dd019099
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: mlops-initialization-cn Version: 1.0.0 The `scripts/init-project.sh` file contains an `echo` statement that instructs the user (or potentially an AI agent) to execute `curl -LsSf https://astral.sh/uv/install.sh | sh` if the `uv` command is not found. While `astral.sh` is the legitimate source for `uv`, this `curl | sh` pattern is a significant prompt injection vulnerability for an AI agent, as it could lead to arbitrary code execution from an external source without explicit user confirmation. This is classified as suspicious due to the high-risk nature of executing remote scripts, even if the immediate intent appears to be benign (installing a legitimate tool).