提供专业C#/.NET项目模板生成、代码编写、架构设计和代码审查支持，涵盖多种应用类型和开发场景。

This skill appears to do what it claims (generate and review C#/.NET projects) but it runs shell commands (dotnet) and writes files. Main risk: command injection via the create-project path — dotnetVersion is interpolated into an unquoted shell argument. Before installing or invoking it: - Review or patch the code to validate/sanitize inputs (allow only numeric version strings like 6, 7, 8 or patterns matching ^\d+(\.\d+)?$). - Replace exec with a safer call (execFile/spawn with args array) or ensure all arguments are properly escaped/quoted. - Run the skill in an isolated environment or container when first testing to limit potential damage from injection or unintended filesystem writes. - Confirm you are comfortable with the skill invoking the dotnet CLI and creating files under the agent's working directory or a specified outputDir. If you cannot review or patch the code, treat the skill as untrusted and avoid running project-creation operations with untrusted inputs.

Type: OpenClaw Skill Name: csharp-developer-jirboy Version: 1.0.0 The skill contains a potential shell injection vulnerability in `index.js` within the `createProject` function. User-controlled parameters such as `dotnetVersion` and `outputDir` are concatenated directly into a shell command string (`dotnet new ...`) executed via `child_process.exec` without sanitization. While the skill's stated purpose of C# development and industrial vibration control appears legitimate, the lack of input validation poses a significant security risk for remote code execution.