Generate HTML landing pages from templates with SEO optimization. Use when creating web pages.

This skill appears to be what it says: a small shell tool for generating and inspecting landing-page HTML. Before using it: (1) inspect scripts/script.sh yourself—there are minor bugs (e.g., some single-quoted echo strings prevent variable expansion) and no HTML escaping when creating output, so do not feed untrusted input if you intend to serve generated pages; (2) be aware it will create ~/.local/share/landing in your home directory; (3) meta/optimize/preview commands read files you pass in—avoid pointing them at sensitive system files; and (4) run the script in a sandbox or review its output if you are cautious. No network access or credential use was found.

Type: OpenClaw Skill Name: landing Version: 3.0.0 The script `scripts/script.sh` contains multiple critical shell injection vulnerabilities because user-supplied arguments (like `$2` and `$3`) are used unquoted in commands such as `grep` and `echo`. This allows for arbitrary command execution if an attacker provides input containing shell metacharacters (e.g., `; id`). Additionally, the script contains an unusual amount of empty comment padding (lines 11–85), which is a common technique to hide malicious code or simply poor practice. While these flaws are severe, there is no explicit evidence of intentional malice or data exfiltration.