Package.json Generator

生成专业的 package.json，包含最佳实践的脚本、依赖和配置。

This skill's marketing and README promise more than the delivered code. Before installing or running it: 1) don't run it in a real project root — it will overwrite package.json without prompting; run it in a disposable directory first. 2) Note SKILL.md shows --name/--type flags but the script only accepts positional name and version — ask the author for a corrected CLI or updated script. 3) If you need true "best-practice" generation (dev/prod deps, validations), use a well-known tool (npm init, create-node-app, Yeoman generators) or review and extend the script yourself. 4) If you still want to use this skill, request the maintainer to add safety checks (refuse to overwrite, back up existing package.json), implement the advertised options, and document exact behavior.

Type: OpenClaw Skill Name: package-json-generator Version: 1.0.0 The `package-json-generator.sh` script directly interpolates user-supplied arguments (`$1` and `$2`) into the generated `package.json` file without proper sanitization or escaping. This creates a JSON injection vulnerability, allowing an attacker to manipulate the structure or content of the `package.json` file by providing crafted input (e.g., containing double quotes or other JSON metacharacters). This is a flaw that allows an attack, classifying it as suspicious rather than malicious, as there is no evidence of intentional harmful behavior like data exfiltration or backdoor installation.