SaaS Landing Page Generator

生成现代 SaaS 产品的 Landing Page，支持多种风格，输出 HTML/CSS/React 代码，直接可部署。

This skill appears coherent and implements what it claims: a simple generator that writes a deployable landing-page scaffold. Before running: (1) inspect the bundled saas-landing-page.sh (you already have it); (2) run it in a disposable directory because it will create an output folder named <product>-landing and write files to disk; (3) review generated HTML/JS for included external CDN references (tailwindcdn, unpkg) — these will load third-party code when the site is visited; (4) note minor implementation quirks (the script uses sed -i '' which is BSD/macOS syntax and may fail on some Linux systems) but those are functional issues, not malicious ones. If you plan to deploy generated sites publicly, review and lock down any third-party asset usage and run standard security checks on the produced code.

Type: OpenClaw Skill Name: saas-landing-page-generator Version: 1.0.0 The `saas-landing-page.sh` script is vulnerable to shell injection. The `sed -i '' "s/PRODUCT_NAME/$PRODUCT/g"` and `sed -i '' "s/DESCRIPTION/$DESCRIPTION/g"` commands directly embed unsanitized user input (`$PRODUCT`, `$DESCRIPTION`) into a `sed` substitution pattern. A malicious user providing crafted input could exploit this to execute arbitrary commands on the system where the script is run, or at minimum, corrupt the generated files. Additionally, the script embeds unsanitized user input directly into the generated HTML files, leading to potential Cross-Site Scripting (XSS) vulnerabilities in the output.