Vue Component Generator

生成 Vue 3 组件模板，支持 Composition API、Options API、TypeScript、SFC 单文件组件，一键生成完整 Vue 组件代码。

This skill's documentation promises a multi-feature CLI but the included script only creates a very simple .vue file from a placeholder name. If you intend to use it, inspect or run the script in a safe directory first; it will write files to the current working directory. Do not expect support for flags like --api, --typescript, or --output unless you install or author a fuller implementation. If you need the advertised features, ask the author for the real CLI implementation or extend the script yourself. Because the discrepancy is significant, treat this skill as untrusted until its claimed features are actually implemented.

Type: OpenClaw Skill Name: vue-component-generator Version: 1.0.0 The `vue-component-generator.sh` script is vulnerable to shell injection and path traversal. The `$NAME` variable, derived directly from user input (`$1`), is used unsanitized in the `sed` command (`sed -i "s/COMP_NAME/$NAME/g" "$NAME.vue"`) and in the filename creation (`"$NAME.vue"`). This allows an attacker to execute arbitrary commands (e.g., by providing `$(command)` as input) or write files to arbitrary locations (e.g., by providing `../sensitive_file` as input). While this is a critical vulnerability, there is no clear evidence of intentional malicious behavior like data exfiltration or persistence mechanisms.