Science Sim Author

Generate self-contained interactive science simulations as a single index.html from a SimSpec YAML or JSON. Use when the user asks for physics, chemistry, bi...

This skill appears internally consistent and designed to generate offline, single-file simulations. Before trusting a generated index.html: open it in a text editor to confirm there are no network/fetch calls, no usage of eval/Function, and no unexpected embedded endpoints; run it locally in a browser (double-click) and verify exports (JSON/CSV) operate client-side. If you plan to deploy or share generated files widely, skim the final JS for any unexpected behavior (the provided template enforces good rules, but the runtime script in the bundle was truncated in the review copy, so a quick manual check adds assurance).

Type: OpenClaw Skill Name: science-sim-author Version: 0.1.3 The skill bundle is designed to generate client-side HTML simulations. While the `SKILL.md` and `rubrics/security_notes.md` contain explicit instructions to the AI agent to prevent code injection (e.g., 'Do not use `eval` or `Function`', 'Do not load remote scripts'), the `templates/sim_single_file_html_template.html` uses raw JavaScript insertion (`{{{model_step_logic_js}}}`, `{{{scene_draw_js}}}`, `{{{readout_map_js}}}`). This creates a significant prompt injection vulnerability, as a malicious user could potentially craft an input SimSpec or prompt that bypasses the agent's safety instructions, leading to arbitrary JavaScript execution in the generated `index.html`. This is a critical vulnerability, but not evidence of intentional malice within the skill bundle itself.