一键生成项目

全自动项目生成和启动器 - 生成完整的Spring Boot + Vue3项目，包含前后端完整代码（RBAC+业务实体）、数据库初始化、编译启动、自动浏览器打开。支持完整CRUD（列表、查询、新增、修改、删除、查看）、多条件查询、状态下拉枚举、Redis配置、Swagger文档，使用JSON配置文件自定义参数。

This skill appears internally consistent with its description, but it performs high‑impact actions: it will write project files, run build commands, and — importantly — connect to the database you provide and execute SQL scripts. Before running it: 1) Do NOT point it at a production database or critical Redis instance. Use a disposable/local DB or container. 2) Inspect the generated SQL (db init scripts) and the Python scripts to confirm they don't DROP or ALTER unintended schemas. 3) Run in an isolated environment (VM/container) so builds and services can't affect your host. 4) Be prepared to install Python deps (pymysql) in a virtualenv. 5) Backup any real data if you must test against an existing DB. 6) If you are uncomfortable providing DB/Redis credentials in a JSON file, do not run the skill. If you want a deeper review, share the generated SQL files (db/init.sql) and the full Python scripts so I can point out specific statements or subprocess calls to watch for.

Type: OpenClaw Skill Name: optimized-one-click-project Version: 1.0.1 The skill bundle provides a project generator that automates the creation and deployment of Spring Boot and Vue3 applications. The primary concern lies in the Python scripts (optimized-start-win.py and optimized-start.py), which use os.system and subprocess.run to execute shell commands constructed directly from user-provided configuration values (e.g., project_name, database parameters) without sanitization. This creates a significant risk of command injection. Additionally, the scripts perform high-risk operations such as writing batch files to disk and executing them, and the generated code includes security weaknesses like hardcoded fallback passwords ('123456'). While these behaviors align with the tool's stated purpose, the execution model is inherently vulnerable to exploitation.