Robots.txt Generator

Generate, validate, and analyze robots.txt files for websites. Use when creating robots.txt from scratch, validating existing robots.txt syntax, checking if...

This skill appears to do only what it says: generate, validate, and test robots.txt files. Things to keep in mind before installing or running it: - The tool may fetch remote robots.txt files over HTTP(S) when you use validate --url; only point it at sites you trust or expect to inspect. - It will read any local file path you pass to --file, so avoid pointing it at unrelated sensitive files (it expects robots.txt content but will read whatever path you give it). - There are no credentials requested and no installer downloads, which reduces risk. If you plan to run the script on sensitive systems, review the full script in your environment (the provided excerpt looked consistent, but always verify the complete file shipped with the skill). - If you want extra caution, run the script in a sandboxed environment or container first.

Type: OpenClaw Skill Name: robots-txt-gen Version: 1.0.0 The skill provides tools for managing robots.txt files but contains functional vulnerabilities. Specifically, scripts/robots_txt_gen.py implements a remote validation feature using urllib.request.urlopen that is susceptible to Server-Side Request Forgery (SSRF) due to a lack of URL sanitization. Additionally, the generate command allows writing to arbitrary file paths via the --output flag. While these features align with the stated purpose, the absence of input validation on URLs and file paths presents a security risk that could be exploited via prompt injection.