by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (scaffolding a Vue2 + Spring Boot low‑code platform) is plausible, but its runtime instructions reference missing scripts/templates and omit important required tools and risks, so the pieces are inconsistent and deserve caution.
评估建议
This skill's purpose is reasonable for scaffolding a low‑code project, but the runtime artifacts you would need to trust are missing or only placeholders. Before installing or running it: 1) Ask for the actual scripts (scripts/generate_project.ps1) and full template contents so you can review them line-by-line. 2) Confirm and install required tools locally (PowerShell, npm, Maven, git, Docker) and ensure the SKILL.md lists them. 3) Do not run builds or scaffold commands on a sensitive machine — ...详细分析 ▾
ℹ 用途与能力
The goal (scaffold frontend/backend, create roles, run npm/mvn, produce docker-compose and CI) aligns with the skill name and description. However the SKILL.md expects a PowerShell script and asset templates to perform that work, yet those runtime artifacts are not actually present or are placeholders. The skill also does not declare the actual required tools (PowerShell, npm, maven, git, docker), which is disproportionate to the claimed purpose.
⚠ 指令范围
Instructions tell the agent to run scripts/generate_project.ps1, run 'npm install' and 'mvn package', copy templates, and commit to a git repo. The referenced script file is not included in the manifest and the templates under assets are placeholders, so the instructions cannot be executed safely as-is. Running the described commands will perform network downloads (npm/maven), filesystem writes, and build-time script execution — none of which are spelled out or constrained in the SKILL.md. The instructions also implicitly require git/docker access but do not mention them.
ℹ 安装机制
There is no install spec (instruction-only), which minimizes written-on-disk installs from the registry, but increases runtime risk because the skill expects to execute build tooling (npm/maven) that will fetch and execute remote packages. Because the actual scaffolding script is missing, it's unclear what code would be run when this skill is invoked in a real agent environment.
⚠ 凭证需求
The skill declares no required environment variables or credentials, yet its docker-compose includes SPRING_PROFILES_ACTIVE and the workflow mentions pushing images/CI pipelines and 'push the repository to a remote' (which would need credentials). The absence of declared required binaries (PowerShell, npm, mvn, git, docker) and missing mention of network activity is a proportionality gap. While no explicit secret-exfiltration step appears, build commands will download third‑party code, which can be an attack vector if run blindly.
✓ 持久化与权限
The skill does not request always:true and is user-invocable with normal autonomous invocation allowed. It does not request to modify other skills or system-wide agent settings. No elevated persistence is requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/18
Initial release of the Low-Code Platform Development skill. - Automates setup of a full low-code platform with Vue2 + ElementUI frontend and Spring Boot backend. - Creates standard project structure, including roles, documentation, and base code for both front-end and back-end. - Adds essential configuration files for Docker, CI pipelines, and security. - Provides starter templates for UI and backend logic, including workflow and data models. - Includes guidance on extending and customizing the platform after initial generation.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install lowcode-platform-development
镜像加速npx clawhub@latest install lowcode-platform-development --registry https://cn.clawhub-mirror.com
技能文档
当...时 到 使用
- 用户 asks 到 build low‑code development platform 使用 Vue2 + ElementUI 对于 UI 和 Java (Spring Boot) 对于 back‑end.
- 用户 wants assistant 到 创建 development roles (frontend, backend, devops, QA) 和 设置 up repository structure automatically.
- 用户 expects platform 到 include page editor, 组件 库, data 模型 manager, workflow engine 作为 described 在...中 architecture overview.
Overview
This skill automates the end‑to‑end setup of the platform:- 创建 project roles (frontend engineer, backend engineer, devops, QA) 和 写入 brief 角色 descriptions 到
docs/roles.md. - Scaffold repository 带有 standard Maven + npm 布局 (
frontend/,backend/). - Generate base code:
- 添加 essential configuration files (
docker‑compose.yml, CI pipeline, security settings). - Commit initial version 到 local Git repository.
- Provide 下一个‑step guidance 对于 extending platform.
Resources
- references/architecture.md – Detailed architecture diagram 和 组件 responsibilities.
- scripts/generate_project.ps1 – PowerShell script runs scaffold commands.
- assets/vue‑模板/ – Minimal Vue2+ElementUI starter 模板.
- assets/spring‑boot‑模板/ – Minimal Spring Boot Maven project 模板.
Steps 到 execute
- Call
scripts/generate_project.ps1带有 target directory. - script creates folder 布局, writes
docs/roles.md, copies 模板 assets, 和 runsnpm install和mvn 包. - 之后 script finishes, skill returns summary 的 什么 是 generated 和 任何 manual actions 必填.
Manual post‑setup actions
- 推送 repository 到 remote 如果 desired.
- customise generated UI components 在...中
frontend/src/components/. - 添加 domain‑specific data models 到
backend/src/main/java/com/app/lowcode/模型/. - Configure authentication/authorization 在...中
backend/src/main/java/com/app/lowcode/security/.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制