Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nginx Reverse Proxy
v1.0.0Configure nginx reverse proxy for domain binding. Trigger when user says "绑定域名" or "配置nginx" or "反向代理" to bind a domain to a specific IP:port.
⭐ 0· 42·0 current·0 all-time
byEthanZhu@cloudswave
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (bind domain to IP:port via nginx reverse proxy) directly match the SKILL.md steps: generate an nginx conf in /etc/nginx/conf.d, test and reload nginx, and optionally run certbot. The requested actions are coherent with the stated purpose.
Instruction Scope
Instructions explicitly modify system config (/etc/nginx/conf.d/{domain}.conf), run privileged commands (sudo tee, sudo nginx -t, sudo systemctl reload nginx) and optionally certbot. They do not read unrelated system files or exfiltrate data, but they rely on user input (domain/target) and do not include guidance to validate or sanitize that input (risk of malformed configs or injection). There are minor template typos in the HTTP example (double braces) that should be fixed.
Install Mechanism
Instruction-only skill with no install spec (lowest install risk). Nothing is downloaded or written by an installer step.
Credentials
The skill declares no required env vars or credentials, which is reasonable, but it does implicitly require system binaries and services (nginx, sudo/systemd, certbot). Those are related to the purpose but should be documented in metadata (required binaries: nginx, certbot, systemctl/sudo) so users know prerequisites.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not attempt to modify other skills or system-wide agent settings. It does perform privileged system changes at runtime (writing system config and reloading services), which is expected for this purpose but requires user consent and appropriate permissions.
Scan Findings in Context
[no_regex_findings] expected: Scanner found no code to analyze because this is an instruction-only SKILL.md; that's expected but means manual review of the instructions is the primary security check.
Assessment
This skill appears to do what it says: create an nginx virtual host file, test and reload nginx, and optionally run certbot to obtain TLS. Before using it, ensure the agent (or the person running the commands) has sudo/root access and that nginx and certbot are installed. Verify DNS for the domain points to your server. Review the generated config before reloading nginx to avoid accidental misconfiguration. Validate and sanitize the domain and target inputs (no newlines, no path traversal, domain is a valid hostname, target is a valid IP:port) to prevent malformed files or injection. Note the SKILL.md doesn't list required binaries (nginx, certbot, systemctl/sudo) — document or confirm those dependencies before installing. If you need stronger assurance, ask the author to add explicit prerequisites and input-validation steps (or run the commands manually yourself).Like a lobster shell, security has layers — review code before you run it.
latestvk97310bg1ywtm5mpg817n7fm9184n61d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.