Invoice Generator Pro

Generate professional invoices in Markdown or HTML by specifying client, items, tax, currency, dates, and output format.

This skill is internally coherent and appears safe for routine use, but consider the following before installing or running it: - Dependency: The script uses the 'bc' command for math but the skill metadata doesn't declare it. Ensure 'bc' is present on your system or the script will fail. - Output overwrite: If you pass --output <path>, the script will overwrite that file without further confirmation. Avoid writing to sensitive locations. - Unescaped user input in HTML: Fields like description, client name, and email are inserted verbatim into template.html (no escaping). If you render generated HTML in a browser and include untrusted input, that could produce unwanted HTML injection. Sanitize user-provided fields when accepting them from untrusted sources. - Safe usage: Review the shipped script and template (they're short and readable). If you plan to run this in an automated or multi-user environment, add input validation/sanitization and run with least privileges. If you want higher assurance, ask the maintainer to (1) list 'bc' as a required binary in the metadata, (2) document any assumptions about file paths, and (3) optionally escape HTML when producing the HTML output.

Type: OpenClaw Skill Name: shelly-invoice-generator Version: 1.0.0 The skill is classified as suspicious due to multiple critical vulnerabilities in `generate-invoice.sh`. User-supplied values for `--item` (specifically 'Qty' and 'Rate') and `--tax` are directly passed to the `bc` command without sanitization, creating a severe shell injection vulnerability that could lead to arbitrary code execution. Furthermore, the `--output` parameter allows writing the generated invoice to an arbitrary file path, posing an arbitrary file write risk. Finally, user inputs are directly inserted into the HTML and Markdown outputs without proper sanitization, leading to potential HTML/Markdown injection (XSS) if the output is rendered.