Self-contained website factory skill for scaffold, build, test, deploy

This bundle is plausibly a legitimate 'website factory' and contains the scaffolds and scripts you'd expect (scaffold, verify, deploy). Before installing or enabling it for autonomous use, do the following: - Inspect index.js (entry) to confirm how it invokes scripts and whether it prompts for explicit approval before any network or deploy steps. - Expect the publish/deploy scripts to call external CLIs: 'vercel' (optionally reads VERCEL_TOKEN), 'gh' (GitHub CLI) and git (SSH). Do NOT provide long-lived credentials globally without review. Prefer ephemeral tokens or limit-scope tokens. - If you plan to let an agent run this skill, either disable autonomous invocation for this skill or require manual approval for any deploy/publish action. The SKILL.md's prose saying 'requires explicit approval' is not enforced by the manifest. - Run the skill inside a sandboxed environment (container or disposable VM) the first few times: the scripts will create directories, run npx/npm (network), start servers on local ports, and write artifacts to factory/artifacts. - If you will use GitHub/Vercel integration, verify that the skill only uses tokens you intend and that it won’t leak them (scan index.js and scripts for any code that sends tokens to external endpoints beyond vercel/gh). Look for any unexpected network endpoints in index.js or backend code (e.g., POSTs to unknown hosts). - If you are not comfortable granting repo or deploy rights, keep credentials out of the agent environment and perform publish/deploy steps manually. If you want, I can open and analyze index.js and any other specific files (e.g., backend/main.py) to confirm exactly how credentials are read, how deploy decisions are gated, and whether there are hidden outbound network calls.

Type: OpenClaw Skill Name: amys-website-factory Version: 1.0.0 The skill bundle provides a comprehensive toolkit for scaffolding, testing, and deploying Next.js websites. It uses a Node.js wrapper (index.js) to orchestrate shell scripts (factory/scripts/) and standard developer tools like the GitHub CLI (gh) and Vercel CLI. While the skill possesses high-privilege capabilities such as executing shell commands, cloning repositories, and deploying code, these actions are strictly aligned with its stated purpose as a 'website factory.' The example sites and the Python FastAPI backend (factory/sites/waifu-chatroom/backend/) contain standard implementations for AI-driven features like STT and TTS without any evidence of malicious intent, data exfiltration, or subversion of the agent's instructions.