WPS Web Builder

从零构建网站和 Web 应用，使用结构化的计划驱动工作流。触发条件：用户要求创建/构建/搭建网站、Web应用、落地页、管理后台、Dashboard 或任何 Web 项目。关键词：'做网站'、'做页面'、'做前端'、'搭建系统'、'做个官网'、'做个后台'、'build website'、'create app'。...

This skill is internally consistent with building web projects: it will read/write project files and run local build/dev commands (including spawning subprocesses and opening a local port). Before using it, review the files it creates, run it in a safe/isolated working directory (or container) if you are uncomfortable with automatic file writes or running build scripts, and avoid providing any unrelated secrets—no credentials are required by the skill. If you want tighter control, ask the agent to show the exact commands it will run before allowing execution.

Type: OpenClaw Skill Name: wps-web-builder Version: 1.0.0 The skill provides a comprehensive framework for building web applications but utilizes high-risk execution patterns in SKILL.md. Specifically, it directs the agent to use Python's subprocess module with shell=True to execute npm and npx commands, which is a known shell injection vulnerability. While these capabilities (file writing and shell execution) are aligned with the stated purpose of a web builder, the lack of input sanitization in the generated command strings and the broad system access required for these operations warrant a suspicious classification.