LQS Skill — prompt/schema/template driven artifact generator for the LQS codebase. Manual-run only: users paste free-text requirement or exported document te...

This Skill appears internally consistent for manual, prompt-driven generation of boilerplate artifacts. Before installing or using it: (1) confirm how your agent/platform handles reading the repository and external URLs — the Skill expects manual paste or user-provided project fragments and explicitly says it won't auto-fetch, but some example text references 'fetching' which could be ambiguous; (2) carefully review any generated migration files and migration_add_menu templates before executing them in any database — templates contain SQL/DB calls and inserting/running migrations will change your DB; (3) when approving 'write' actions, ensure the target paths and diffs are acceptable, and that backups are created for overwritten files; (4) since the Skill can write files when you approve, verify the platform prompts the user before any file writes and that you (or an external CI) control execution of migrations. If you need absolute assurance that no automatic fetching or repo scanning will occur, ask the skill author (or inspect runtime plumbing) to confirm the agent will only operate on user-supplied text and the included .skill assets.

Type: OpenClaw Skill Name: lqs-skill Version: 1.0.1 The skill is a code generation assistant designed to create PHP artifacts (controllers, models, and migrations) for the LQS project. While it includes numerous safety instructions—such as requiring manual approval before writing files and explicitly forbidding the automatic execution of migrations—it possesses high-risk capabilities. Specifically, the migration template in `templates/generated/migration_create_table.txt` contains a fallback mechanism (`fields_block`) that inserts unvalidated text directly into SQL statements, creating a potential path for SQL injection if the AI agent is manipulated via prompt injection. The core functionality of writing executable PHP code to the filesystem based on AI-interpreted requirements is inherently risky.