Generate a compliant legal website with Privacy Policy, Terms, support, and data deletion pages, ready for Cloudflare Pages deployment.

This skill is not obviously malicious, but it is inconsistent and incomplete: SKILL.md promises multiple legal pages, yet the handler only writes a placeholder index.html. Before installing or invoking it: (1) review skill.js locally and run it in an isolated or empty directory to avoid unexpected file writes; (2) if you expect full privacy/terms/delete pages, update the handler to call the provided generation functions and write those HTML files, or reject the skill; (3) note that sanitize() only escapes < and > — if you plan to inject attributes or rich content, review and strengthen escaping/encoding to avoid HTML injection; (4) confirm contact email inputs and test the generated output to ensure the legal text meets your requirements. If you need the promised full-site behavior, ask the author for a fixed handler implementation or patch it yourself.

Type: OpenClaw Skill Name: legal-site-generator Version: 1.0.1 The skill is classified as suspicious due to a Cross-Site Scripting (XSS) vulnerability in the generated output. The `handler` function in `skill.js` directly embeds `input.appName` and `input.contactEmail` into the `dist/index.html` file without proper HTML sanitization. While the file defines a `sanitize` function and uses it in other document generation functions, the primary `handler` fails to apply it to the `index.html` it actually creates, making the output vulnerable to XSS if malicious input is provided for these parameters.