项目宣传页和长截图一键生成工具

一键生成项目介绍页，支持本地编辑和长图导出。

This skill appears to implement exactly the advertised features, but it has a concrete security flaw you should consider before installing or running it on sensitive hosts: src/git.js uses execSync(`git clone --depth 1 ${gitUrl} ...`) with the gitUrl interpolated directly into a shell command, which can allow command injection if a malicious git URL is provided. Recommendations: - Do not run this skill with access to sensitive files or credentials unless you audit/mitigate the code first. - If you need git clone support, prefer running it only with trusted repository URLs, or modify the code to use a spawn variant with an args array (no shell) or a safe git library. - Run the skill in an isolated environment (container, VM) if you will pass untrusted git URLs or project paths. - Be aware the generated HTML loads html2canvas from jsdelivr; if you edit/open the generated page in a browser, that remote script will run. If your threat model excludes remote scripts, remove/host that dependency locally. - If you are not comfortable reviewing or patching the code, test the skill on non-sensitive sample projects only.

Type: OpenClaw Skill Name: project-intro-generator Version: 0.1.3 The skill bundle contains a command injection vulnerability in `src/git.js`, where the `gitUrl` parameter is passed directly to `execSync` without sanitization. Additionally, `src/image.js` utilizes `playwright` to render HTML and capture screenshots, which presents a risk of local file disclosure or SSRF if the input paths or URLs are not strictly controlled. While these are high-risk vulnerabilities that could lead to Remote Code Execution (RCE), the extensive logic for project analysis and dependency mapping suggests a legitimate utility rather than intentional malware.