Reactive Resume

Reactive Resume 开源简历构建器开发指南。使用 TanStack Start (React 19 + Vite)、PostgreSQL + Drizzle ORM、ORPC (Type-safe RPC)、Better Auth。当用户需要：(1) 本地开发环境搭建，(2) 自定义模板开发，(3)...

This skill is a development guide and includes helper scripts; it is not trying to hide malicious behavior, but you should be careful before running anything: 1) Inspect .env/.env.example — the docs expect DATABASE_URL, PRINTER_ENDPOINT, and other secrets; never point DATABASE_URL at a production DB. 2) The scripts include db-reset.py which will drop all tables via psql — run it only against a dev database and read the script to understand its prompts. 3) db-reset.py uses subprocess with shell=True and constructs shell commands from DATABASE_URL; avoid running it on untrusted input. 4) create-template.py writes files into your repo; review paths before running. 5) The docs recommend starting dockerd with sudo and running docker compose — these are normal for self-hosting but require root and network access. If you plan to let an agent invoke this skill autonomously, be aware it may instruct the agent to run system commands that can modify your environment; prefer manual invocation and confirm environment variables and target systems first.

Type: OpenClaw Skill Name: reactive-resume Version: 1.0.0 The skill bundle contains a shell injection vulnerability in `scripts/db-reset.py`, where the `DATABASE_URL` environment variable is unsafely interpolated into a `subprocess.run(shell=True)` call. Additionally, `SKILL.md` contains instructions for the AI agent to execute high-privilege commands (`sudo dockerd`), which increases the attack surface. While these scripts and instructions appear intended for legitimate local development of the 'Reactive Resume' project, the lack of input sanitization and the requirement for elevated privileges pose a security risk in an automated environment.