← 返回 Skills 市场
Stack Scaffold
作者
Guilherme Favaron
· GitHub ↗
· v0.1.2
· MIT-0
799
总下载
1
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install stack-scaffold
功能描述
Scaffolds a full-stack project with Next.js App Router, Supabase, Firebase Auth, Vercel, and Cloudflare
安全使用建议
This skill mostly looks like a legitimate project scaffolder, but the package metadata (claw.json) asks for many sensitive environment variables — including the Firebase private key — which are not needed just to create files. Before installing or running it: (1) prefer not to supply secrets to the skill/agent; scaffolding should be done in an empty/new directory without exposing credentials, (2) verify the source (claw.json claims a GitHub homepage but the skill metadata says 'unknown'); prefer skills from a known repository, (3) inspect the generated files (especially any server-side admin initialization like firebase admin) to ensure private keys are not accidentally committed and that .gitignore includes env files, (4) if you must use runtime credentials, create minimal test credentials and never provide production private keys to an agent, and (5) ask the publisher why the metadata marks env vars as required despite SKILL.md saying it won't read .env files — this inconsistency should be resolved before trusting the skill.
功能分析
Type: OpenClaw Skill
Name: stack-scaffold
Version: 0.1.2
The 'stack-scaffold' skill is a legitimate project generator for Next.js, Supabase, and Firebase. It includes a robust 'Planning Protocol' that explicitly instructs the AI agent to avoid reading or modifying existing sensitive files like .env or credentials, which is a strong security-positive design. The requested filesystem and network permissions are appropriate for its stated purpose of running 'npx create-next-app' and 'npm install' for standard, well-known dependencies (SKILL.md, claw.json).
能力评估
Purpose & Capability
The SKILL.md describes a scaffolding tool and its runtime instructions align with that purpose (creating files, running npx create-next-app, initializing git). However claw.json requires numerous environment variables (including FIREBASE_PRIVATE_KEY, FIREBASE_CLIENT_EMAIL) that a scaffolder does not need to run; these are disproportionate and do not match the stated purpose. Required binaries (node, npx, git) are reasonable.
Instruction Scope
The SKILL.md mandates a Planning Protocol and explicitly forbids reading existing .env or credential files; it instructs only to run `ls` and `node -v` to verify the target directory and to create files and run npx commands. The file templates reference process.env.* placeholders (expected for scaffolding). There are no instructions to transmit secrets or inspect unrelated system files. Overall the runtime instructions are scoped to scaffolding, but they rely on templates that assume sensitive env vars exist at runtime.
Install Mechanism
This is an instruction-only skill with no install spec and no code files executed by the platform; that minimizes install-time risk. The skill will instruct the agent to run system tooling (npx, npm) which is expected for a scaffolder.
Credentials
claw.json declares many required env variables (NEXT_PUBLIC_SUPABASE_*, NEXT_PUBLIC_FIREBASE_*, FIREBASE_PRIVATE_KEY, FIREBASE_CLIENT_EMAIL, etc.). For scaffolding files, requesting runtime secrets (especially FIREBASE_PRIVATE_KEY) is unnecessary and excessive. The SKILL.md explicitly says it will not read .env files, creating a direct contradiction with the metadata that marks those env vars as required. This mismatch is the primary security concern.
Persistence & Privilege
The skill is user-invocable, not always-enabled, and does not request unusual persistence. Recommended skillDependencies and permissions in claw.json (filesystem, network) are expected for scaffolding and template fetching.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install stack-scaffold - 安装完成后，直接呼叫该 Skill 的名称或使用
/stack-scaffold触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.2
stack-scaffold 0.1.2
- Added a CHANGELOG.md file to the project.
- Updated SKILL.md with no functional or protocol changes.
- Updated claw.json (details not shown).
v0.1.1
stack-scaffold 0.1.1
- Adds a strict policy to only scaffold new projects in empty/new directories; prevents any reading or modification of existing .env, credential, or .env.local files.
- Always prompts users to confirm project name and target directory before file creation.
- Clarifies that, if a directory already has content, user confirmation is required before proceeding.
- Ensures .gitignore contains required entries and explicitly never reads environment or credential files.
- Updates documentation to reflect these new safety and confirmation protocols.
v0.1.0
Initial public release of stack-scaffold
- Scaffolds a full-stack project using Next.js App Router, Supabase, Firebase Auth, Vercel, and Cloudflare.
- Enforces a mandatory Planning Protocol before any action, including user clarification, environment survey, step-by-step execution plan, risk identification, and clear summarization.
- Creates an opinionated `src/` directory structure with ready-to-use files for Supabase, Firebase, authentication middleware, hooks, and state management.
- Installs essential dependencies for development, authentication, testing, and code formatting.
- Generates helpful example files, including API health check, environment variable templates, Vercel config, and Vitest config.
元数据
常见问题
Stack Scaffold 是什么？
Scaffolds a full-stack project with Next.js App Router, Supabase, Firebase Auth, Vercel, and Cloudflare. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 799 次。
如何安装 Stack Scaffold？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install stack-scaffold」即可一键安装，无需额外配置。
Stack Scaffold 是免费的吗？
是的，Stack Scaffold 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Stack Scaffold 支持哪些平台？
Stack Scaffold 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Stack Scaffold？
由 Guilherme Favaron（@guifav）开发并维护，当前版本 v0.1.2。
推荐 Skills