Skill Template

OpenClaw Skill template generator. Create skill scaffolds, validate structure, enhance SKILL.md, generate command frameworks, tips, publish checklists.

This skill appears to do what it says: a local template generator and a tiny data-logging CLI. Before installing or invoking: 1) Note it will create and write to a data directory (~/.local/share/skill-template by default) and append commands/arguments to history.log — don't store secrets or passwords via the tool. 2) It requires bash and python3; ensure those match your environment. 3) The validator/enhancer reads SKILL.md and tips.md in any target directory you give it — avoid validating directories that contain sensitive files unless you intend the skill to read them. 4) Review the included scripts if you want to be extra cautious; they contain no network calls or credential handling.

Type: OpenClaw Skill Name: skill-template Version: 2.0.1 The bundle contains multiple critical shell injection vulnerabilities in 'scripts/script.sh'. Functions such as 'cmd_add', 'cmd_run', and the internal '_log' utility use 'echo' with double-quoted variables (e.g., '$*', '$1') that do not sanitize user input, allowing for arbitrary command execution via command substitution (e.g., '$(payload)'). Additionally, the 'search' command in the same file is vulnerable to argument injection in 'grep' (e.g., using '--file' to read arbitrary files). While these are high-risk vulnerabilities, they appear to be unintentional coding flaws in a template scaffold rather than intentional malicious behavior.