Skill blocked — malicious content detected
ClawHub Security flagged this skill as malicious. Downloads are disabled. Review the scan results below.
Senior Frontend
v2.1.1Frontend development skill for React, Next.js, TypeScript, and Tailwind CSS applications. Use when building React components, optimizing Next.js performance,...
⭐ 0· 1.6k·15 current·15 all-time
byAlireza Rezvani@alirezarezvani
MIT-0
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (React/Next.js/TS/Tailwind tasks) align with the included files: a project scaffolder, component generator, and bundle analyzer plus extensive references. The required surface (no external credentials, no unusual binaries) is proportionate to a frontend helper.
Instruction Scope
SKILL.md instructs the agent to run the included Python scripts against a project directory and to run npm commands. The scripts legitimately read package.json and scan source files (bundle_analyzer) and create files/directories (frontend_scaffolder, component_generator). However, the generators accept user-supplied names/paths and write files without visible sanitization. That means a malicious or malformed argument could cause unexpected writes/overwrites or create paths outside the intended directory (path traversal). The analyzer also reads arbitrary files under the provided project path, so running it against a broad path (e.g., /) could expose unrelated sensitive files.
Install Mechanism
No install spec — instruction-only with bundled Python scripts. This reduces supply-chain risk (no external downloads), but the included scripts will be executed when invoked.
Credentials
The skill declares no required environment variables or credentials. The scripts reference common frontend dependencies conceptually but do not request secrets or external tokens. There is no disproportionate credential access.
Persistence & Privilege
always:false and the skill does not request persistent platform privileges. It does perform filesystem writes when you run the scaffolder/generator (expected behavior), but it does not attempt to modify other skills or system-wide agent config.
What to consider before installing
This skill is functionally coherent for frontend work, but exercise caution before running its scripts. 1) Review the Python files locally — they read project files and will write/overwrite files and directories. 2) Run generators with --dry-run first or target an empty/sandbox directory to confirm output. 3) Avoid running these scripts as a privileged user or against system/root paths. 4) Inspect and (if needed) harden the component_scaffolder/generator to sanitize user-supplied names (reject '../', absolute paths, control characters) to prevent path traversal or accidental overwrites. 5) If you allow the agent to invoke the skill autonomously, restrict what arguments it can pass (or disallow autonomous invocation) because the scripts can modify the filesystem. If you want, I can point to exact lines in the scripts that should be hardened or suggest safe sanitization code.scripts/frontend_scaffolder.py:380
Environment variable access combined with network send.
Critical security concern
These patterns indicate potentially dangerous behavior. Exercise extreme caution and review the code thoroughly before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk970vbnjmydh14fswrw9vm3c3h82kfex
License
MIT-0
Free to use, modify, and redistribute. No attribution required.