Nginx Config Creator

Creates a standard Nginx/OpenResty reverse proxy config file for a service and reloads the web server. Features safety checks and environment awareness. Takes service name, domain, and port as main arguments.

This skill appears to implement the stated feature, but review and run it carefully: - Inspect the script before running and only supply trusted inputs. SERVICE_NAME and CONFIG_PATH are used directly to build the output filename, so avoid untrusted values (e.g., no '../', absolute paths, or shell metacharacters). - Run in a safe environment first (staging) to confirm behavior and container identity; ensure the provided Docker container actually runs Nginx/OpenResty and that you have appropriate permissions. - Because the script writes and may delete files, back up existing configs and ensure CONFIG_PATH points to the intended conf.d directory (avoid symlink surprises). - Note the small metadata mismatch: the registry lists no required env vars but the README/SKILL.md recommend NGINX_CONFIG_PATH and NGINX_CONTAINER_NAME. If you plan to use environment variables, set them deliberately. - Consider hardening the script (input validation, safer tempfile handling, limiting allowed paths) before using it in production. If you need help auditing or patching the script to reject path traversal and validate inputs, I can suggest concrete modifications.

Type: OpenClaw Skill Name: nginx-config-creator Version: 0.1.1 The `scripts/create-and-reload.sh` script is classified as suspicious due to risky capabilities without clear malicious intent. It allows writing to an arbitrary file path (`$CONF_FILE_PATH`) and executing commands (`nginx -t`, `nginx -s reload`) within a user-specified Docker container (`$CONTAINER_NAME`). While these actions are necessary for the skill's stated purpose of managing Nginx configurations, the script lacks robust input validation for `--config-path` and `--container-name`, potentially allowing a malicious actor to write to sensitive host paths or execute commands in unintended containers if they control the inputs. There is no evidence of data exfiltration, persistence, or direct prompt injection attempts.