React Component Generator

生成 React 组件模板，支持 Function Component, Class Component, Hooks, TypeScript，一键生成完整组件代码。

This skill appears low-risk but is inconsistent with its documentation. Before installing or using it: (1) review the react-component-generator.sh script — it simply creates a basic .jsx function component and replaces the placeholder string; it does not implement TypeScript (.tsx), hooks, class components, or the CLI flags shown in SKILL.md; (2) be aware the script writes to the current directory and will overwrite an existing file named <ComponentName>.jsx without prompting; (3) sed -i usage may be non-portable on macOS (may require a backup suffix); (4) if you expect TypeScript or other templates, either extend the script or source a different implementation; (5) only install/run if you’re comfortable with the above and after backing up that directory. If you want this skill to be trustworthy, ask the author for an updated implementation that matches the documented features and a proper install mechanism (or include clear instructions how to make the script executable and available as the named CLI).

Type: OpenClaw Skill Name: react-component-generator Version: 1.0.0 The `react-component-generator.sh` script is vulnerable to path traversal and lacks input sanitization. The component `NAME` (derived from user input `$1`) is directly used in the filename `"$NAME.jsx"` and within a `sed` command, allowing an attacker to create files in arbitrary directories (e.g., `../../../../tmp/evil.jsx`) or potentially break the `sed` command with specially crafted input. This constitutes a significant vulnerability, classifying the skill as suspicious.