MLOps Validation CN
v1.0.0Rigorous validation with typing, linting, testing, and security
⭐ 0· 472·0 current·0 all-time
byGuohongbin@guohongbin-git
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, SKILL.md, conftest.py and pre-commit config all align with an MLOps validation helper: linting (ruff), typing (mypy), testing (pytest), and security (bandit). However the skill declares no required binaries or dependencies even though the runtime instructions require many tools (pre-commit, pytest, ruff, mypy, bandit) and the fixtures require pandas, numpy and scikit-learn, which is an omission/under-declaration.
Instruction Scope
Instructions are narrowly scoped to copying pre-commit config and pytest fixtures and running standard lint/test/security commands. They do instruct cp operations that will overwrite .pre-commit-config.yaml and tests/conftest.py in target locations (risk of accidental overwrite). The pre-commit install will fetch and run hooks from remote repositories (normal but worth reviewing). The SKILL.md does not instruct reading unrelated system files or exporting credentials.
Install Mechanism
No install spec (instruction-only), so nothing is automatically downloaded or written by the skill package itself. The only network activity occurs later when users run pre-commit (which fetches hooks from GitHub repos). The pre-commit repos are pinned to specific revisions and are well-known projects (ruff, bandit, pre-commit-hooks, mirrors-mypy, nbQA).
Credentials
The skill requests no environment variables or credentials, which is consistent with its benign purpose. But it also fails to declare required binaries/dependencies (pytest, pandas, numpy, scikit-learn, pre-commit, ruff, mypy, bandit), so a user following the instructions might run commands without realizing prerequisites are missing.
Persistence & Privilege
always:false and default autonomous invocation is used (normal). The skill does not request persistent privileges, modify other skills, or claim system-wide configuration changes. No suspicious persistence behavior is present in the provided files.
What to consider before installing
This skill appears to do what it says (adds pre-commit hooks and pytest fixtures) but there are a few practical and safety checks you should do before using it:
- Review the files before copying: the commands in SKILL.md call cp to overwrite .pre-commit-config.yaml and tests/conftest.py in your project — back up any existing files first.
- Check required tools and libraries: the SKILL.md assumes you have pre-commit, pytest, ruff, mypy, bandit installed and your project has pandas, numpy, and scikit-learn for the fixtures; the package metadata does not list these prerequisites. Install them in a virtualenv or test environment first.
- Inspect the pre-commit config: pre-commit will fetch and execute hooks from remote GitHub repos. The config uses pinned revisions from well-known projects (ruff, bandit, etc.), which reduces risk, but you should still inspect the hook list and revisions to be comfortable with what will run on each commit.
- Test in isolation: try the copy/install/run steps in a throwaway branch or sandbox repository so you can confirm nothing is unexpectedly overwritten or fails.
If you want me to, I can (1) list the exact packages/commands you'll need to install to run the skill successfully, (2) show a diff of what copying the two files would change against a provided repository, or (3) check the referenced pre-commit repo revisions for known issues.Like a lobster shell, security has layers — review code before you run it.
chinesevk9758stggv49r518qdfrkg59fs81e2qslatestvk9758stggv49r518qdfrkg59fs81e2qsmlopsvk9758stggv49r518qdfrkg59fs81e2qs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.