Vibe Coding Cn

AI 团队协作，自动生成完整项目。5 Agent + SPEC.md + Agent 投票审批 + 需求追溯。必须在 OpenClaw 环境中使用。

This skill appears to implement the described multi‑agent project generator and mostly asks for proportional capabilities (node, OpenClaw sessions). However, it is designed to make automated decisions and save generated files into your workspace — sometimes explicitly without waiting for user approval. Before installing or enabling it: 1) Review the executor code (executors/vibe-executor-v4.1.js and index.js) to confirm when and how saveFiles()/file writes are triggered. 2) Test the skill in a disposable/sandbox workspace to observe what it writes and whether it asks you to confirm changes. 3) Avoid running optional servers (the 'ws' dashboard) unless you trust the environment and have checked the server code. 4) If you want tighter control, require the skill to run only in a user‑invoked mode or modify it so every save/action requires explicit user confirmation. 5) If you lack time to audit code, treat the skill as potentially able to modify local files and proceed accordingly (backup important workspaces first).

Type: OpenClaw Skill Name: vibe-coding-cn Version: 4.1.0 The skill bundle exhibits a significant discrepancy between its declared permissions in 'claw.json' (which claims no network access) and its actual implementation. Specifically, 'server.js' starts a local HTTP and WebSocket server for progress monitoring, and 'executors/llm-client.js' contains logic for outbound HTTPS requests to the Alibaba DashScope API. While these features are aligned with the tool's stated purpose of project generation and visualization, the misleading manifest is a security concern. Furthermore, 'executors/vibe-executor-v4.1.js' uses 'child_process.exec' to open directories, which, although intended for UX, presents a potential shell injection risk if the project directory name is not perfectly sanitized. The skill also requests broad 'sessions_spawn' and 'exec' capabilities.