OpenGemini SaaS Builder

Build SaaS projects end-to-end with OpenClaw as orchestrator and Gemini CLI as a local planning and generation copilot. Use when the user asks to brainstorm,...

This skill appears to do what it says: generate docs, scaffold files, create GitHub repos (via gh), and deploy to Vercel (via vercel) when you explicitly request those actions. Before installing or invoking: 1) ensure you have and trust the gh, vercel, and gemini CLIs on your machine and that their authenticated accounts are the ones you want used; the scripts will call those CLIs and may push your current repository. 2) Never include secrets or sensitive credentials in prompts or allow the skill to auto-generate .env files with real credentials—review .env.example and any generated files before use. 3) Confirm external side effects explicitly when prompted (repo creation/push/deploy). 4) If you plan to allow autonomous invocation broadly, be aware an agent could attempt actions using installed CLIs if it misinterprets user intent; require explicit confirmation for destructive or external actions. If you want more assurance, review the helper scripts locally (they are small and readable) and test in a disposable repo before using on important projects.

Type: OpenClaw Skill Name: opengemini-saas-builder Version: 1.0.0 The skill bundle contains shell injection vulnerabilities in several helper scripts, including generate_architecture.sh, generate_requirements.sh, and generate_rules.sh. These scripts embed unsanitized variables ($project and $brief) directly into shell command strings passed to the gemini CLI, which could lead to arbitrary command execution if the agent processes malicious user input. While the SKILL.md instructions include safety guidelines and require user approval for external actions like GitHub repo creation and Vercel deployment, the lack of input validation in the underlying shell scripts represents a significant security flaw.