React Nextjs Generator

Generates complete React Next.js projects from requirements and UI designs using Ant Design, Tailwind CSS, and Zustand for state management.

This skill appears to do what it claims (generate Next.js projects), but exercise caution before running it: - Review the included files (create-react-app.sh, generator.ts, runner.ts) yourself. The shell script runs `npx create-next-app` and `npm install`, which will download and execute third-party packages from the network. - Do not run the scripts on a sensitive machine without inspection—use a disposable or sandboxed environment (container or VM). - The controller docs reference a hardcoded local path (/Users/batype/...), which likely won't match your environment; expect to supply correct paths or adjust invocation. - The generator constructs filesystem paths from parsed text in the requirements document without sanitization. Malicious or malformed requirements could cause files to be written outside the intended output directory (path traversal). Validate or sanitize any user-provided input and always set an explicit output directory you control. - If you plan to use it, test first with minimal, well-formed requirements in an isolated workspace, and run `npm install` and `npm run dev` yourself after reviewing package.json. What would change this assessment: evidence that input strings are sanitized/validated before use (prevents path traversal), removal of hardcoded local paths in docs, or signatures/source provenance showing the code comes from a trusted author. Without those, treat the skill as functional but potentially unsafe.

Type: OpenClaw Skill Name: react-nextjs-generator Version: 1.0.0 The skill bundle is suspicious due to multiple critical input sanitization vulnerabilities that could lead to Remote Code Execution (RCE) and arbitrary file writes/code injection into generated projects. Specifically, `create-react-app.sh` is vulnerable to shell injection via unsanitized `PROJECT_NAME` and `OUTPUT_DIR` arguments. The `generator.ts` script is vulnerable to path traversal and code injection into generated files because it directly uses unsanitized user input from `requirementsDoc` for file paths and content. The `OpenClaw-Skill.md` and `controller.md` explicitly instruct the AI agent to use the `exec` tool to run these vulnerable scripts (`runner.ts` and `create-react-app.sh`), making the agent susceptible to prompt injection leading to RCE if it does not perform its own robust input sanitization before passing user-controlled data.