Build
v1.2.1生成定制化的构建项目 Skill（含 SKILL.md + references/），为用户的构建过程提供从规划到结项的 持续引导。触发场景：用户表达想做一个项目（"我想做个 X""帮我开发一个 X""搭个 X" "写个 X""做个 X 出来""build X""create X""develop X""make...
⭐ 1· 157·0 current·0 all-time
byBalancegogogo@balancegsr
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description and artifacts (SKILL.md + references templates) align: the skill is a 'creator' that generates project-management skills and persists project files. It does not request unrelated credentials or binaries. Writing/reading project files and probing for agent skill directories is coherent with the stated install/delivery behavior.
Instruction Scope
Most runtime instructions stay within expected scope: two-round intake, template substitution, then optionally writing files into a project directory and references. The skill explicitly instructs scanning the workspace and several home/global skill-path candidates (e.g., ~/.claude/, ~/.agents/skills/, .agents/skills/). Scanning those locations and creating files there is explainable by the need to install into an agent's skill folder, but it is broader than 'only write a single file' — it touches the workspace root and user home probing multiple platform paths. This is intentional for installation but worth noting to users who don't want automated scans of their home/workspace.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is downloaded or executed beyond the agent's normal file I/O. That is a low-risk install model. The skill will write Markdown files into a discovered skill prefix or project_dir during Phase 3 (user-confirmed), which is expected behavior for this creator.
Credentials
The skill requests no environment variables or credentials. It does not declare access to unrelated secrets. Its file reads/writes are scoped to the discovered skill prefix and generated project_dir. No hidden external endpoints or tokens are requested.
Persistence & Privilege
The skill writes persistent files into the workspace and into agent skill directories (when user chooses 'direct install'). always:false and no request to modify other skills' configs are present. Because it can install itself into a global skill prefix, users should confirm the target path; autonomous invocation is allowed by the platform default but is not required by the skill to do its generation work.
Scan Findings in Context
[none_found_by_regex_scanner] expected: No regex-based scan findings (the package is instruction-only). This absence is expected because there are no code files for the static scanner to analyze.
Assessment
This skill is coherent with its purpose: it will ask two rounds of questions, generate a SKILL.md plus references, then (only after you confirm) either write the generated files into a discovered agent skill directory or package them as a ZIP. Before confirming installation: 1) review the generated SKILL.md preview the creator shows; 2) confirm the exact installation path (it probes workspace and home-level skill dirs and may create files under .agents/skills/ or similar); 3) if you prefer isolation, choose ZIP delivery and unpack in a controlled location; 4) be aware the skill will read/write project files (plan.md, decisions.md, etc.) and may probe for existing skill directories — if you have sensitive files in the workspace/home, run the process in a dedicated folder. If you want stricter limits, ask the creator to only produce the ZIP and avoid direct installation.Like a lobster shell, security has layers — review code before you run it.
latestvk977v607stdkeedbgs4cwv46gx83wark
License
MIT-0
Free to use, modify, and redistribute. No attribution required.