web-front

网站前端生成技能。根据用户需求生成HTML/CSS/JS前端页面， 自动保存到指定目录并在浏览器中打开预览。 学习主流网站的设计并记录在学习资源目录中。

This skill is coherent with a web front-end generator, but take these precautions before installing or granting it broad access: 1) Inspect SKILL.md raw bytes (or view hidden/unicode control characters) to ensure there are no hidden instructions or obfuscated content. The scanner flagged unicode-control-chars which can hide text. 2) Confirm what {baseDir} will resolve to in your environment. The skill uses rm -rf "{baseDir}/html/{项目名}" and other file-system operations — ensure baseDir is restricted to a sandbox or test folder so deletions can't affect important data. 3) Limit the skill's write/read permissions to the intended directory (chroot, container, or explicit path mapping) and do a test run in an isolated environment first. 4) Consider disabling or restricting shell command execution that opens the system browser if you run in an environment where those commands have broader side effects. 5) Because the package is instruction-only, review the provided learning/ and html/ files (they are included) for unexpected remote endpoints or obfuscated scripts. If you want higher assurance, run the skill in a disposable VM/container and verify its behavior before use in production.

Type: OpenClaw Skill Name: uwvwko-web-front Version: 1.0.0 The skill bundle implements a web front-end generator with extensive file management capabilities, including the use of high-risk system commands like 'rm -rf' for project deletion and 'start/open/xdg-open' for browser previews (SKILL.md). While these features align with the stated purpose, the instructions lack explicit safeguards or sanitization for user-provided project names, creating a significant surface for path traversal or unintended file deletion. Additionally, the 'learning mechanism' involves the agent autonomously reading and updating local markdown files, which could be exploited via prompt injection to manipulate the agent's behavior or access unauthorized directories.