Stack Scaffold

Scaffolds a full-stack project with Next.js App Router, Supabase, Firebase Auth, Vercel, and Cloudflare

This skill mostly looks like a legitimate project scaffolder, but the package metadata (claw.json) asks for many sensitive environment variables — including the Firebase private key — which are not needed just to create files. Before installing or running it: (1) prefer not to supply secrets to the skill/agent; scaffolding should be done in an empty/new directory without exposing credentials, (2) verify the source (claw.json claims a GitHub homepage but the skill metadata says 'unknown'); prefer skills from a known repository, (3) inspect the generated files (especially any server-side admin initialization like firebase admin) to ensure private keys are not accidentally committed and that .gitignore includes env files, (4) if you must use runtime credentials, create minimal test credentials and never provide production private keys to an agent, and (5) ask the publisher why the metadata marks env vars as required despite SKILL.md saying it won't read .env files — this inconsistency should be resolved before trusting the skill.

Type: OpenClaw Skill Name: stack-scaffold Version: 0.1.2 The 'stack-scaffold' skill is a legitimate project generator for Next.js, Supabase, and Firebase. It includes a robust 'Planning Protocol' that explicitly instructs the AI agent to avoid reading or modifying existing sensitive files like .env or credentials, which is a strong security-positive design. The requested filesystem and network permissions are appropriate for its stated purpose of running 'npx create-next-app' and 'npm install' for standard, well-known dependencies (SKILL.md, claw.json).