NextJS Frontend Development + Integration

Generate production-ready Next.js projects with TypeScript, Tailwind CSS, shadcn/ui, and API integration. Use when the user asks to build, create, develop, or scaffold a Next.js application, web app, full-stack project, or frontend with backend integration. Prioritizes modern stack (Next.js 14+, TypeScript, shadcn/ui, axios, react-query) and best practices. Also triggers on requests to add features, integrate APIs, or extend existing Next.js projects.

Install only if you are comfortable with a frontend skill that can manage local dev servers and may suggest sudo-based preview setup. Keep previews localhost-only by default, review any Nginx or sudo command before allowing it, avoid unscoped kill/delete-all PM2 commands, and do not use real credentials in generated .env.local files unless you are sure they will not be committed, zipped, screenshotted, or shared.

Type: OpenClaw Skill Name: frontend-dev Version: 0.1.1 The skill is classified as suspicious due to several high-risk capabilities and vulnerabilities. Most notably, the `scripts/screenshot.sh` script executes `chromium` with the `--no-sandbox` flag, which is a critical security vulnerability that could lead to arbitrary code execution on the host system if the URL parameter is manipulated or if the rendered web content is malicious. Additionally, the `SKILL.md` instructs the agent to use `sudo` for installing system-level packages (Chromium, Nginx) and modifying Nginx configuration, granting significant elevated privileges. The extensive use of `pm2` for process management, including `pm2 save`, also introduces a persistence mechanism for processes started by the agent. While these capabilities are presented for legitimate development purposes, they pose substantial security risks if the agent is compromised via prompt injection or if the generated project contains vulnerabilities.