Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Vue Component Generator
v1.0.0生成 Vue 3 组件模板，支持 Composition API、Options API、TypeScript、SFC 单文件组件，一键生成完整 Vue 组件代码。
⭐ 1· 528·5 current·5 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md advertises many features (Composition/Options API, TypeScript, script-setup, SCSS, --api/--typescript/--output flags, multiple component types). The provided artifact (vue-component-generator.sh) only accepts an optional first positional name and writes a basic template by replacing a placeholder; it does not parse flags, support TypeScript/SCSS generation, or respect an output directory. This is a clear mismatch between declared capabilities and actual code.
Instruction Scope
Instructions show CLI usage examples that imply support for multiple flags and output control, but runtime behavior (the shell script) only uses the first argument as a component name and writes a file in the current directory. The instructions do not request credentials or access to unrelated files; generated files will be written to the current working directory. Also note sed -i is used (may behave differently on macOS), which is a portability issue but not a security concern.
Install Mechanism
No install spec is provided (instruction-only with an included shell script). No external downloads or package installs are declared. This minimizes install-time risk.
Credentials
No environment variables, credentials, or config paths are required or requested. The skill does not attempt to access unrelated secrets or system configuration.
Persistence & Privilege
The skill is not always-included and has no special persistence or system-wide configuration changes. It does not modify other skills or agent settings.
What to consider before installing
This skill's documentation promises a multi-feature CLI but the included script only creates a very simple .vue file from a placeholder name. If you intend to use it, inspect or run the script in a safe directory first; it will write files to the current working directory. Do not expect support for flags like --api, --typescript, or --output unless you install or author a fuller implementation. If you need the advertised features, ask the author for the real CLI implementation or extend the script yourself. Because the discrepancy is significant, treat this skill as untrusted until its claimed features are actually implemented.Like a lobster shell, security has layers — review code before you run it.
componentvk973b3beq9aczx0cg2423a22t9824k6tfrontendvk973b3beq9aczx0cg2423a22t9824k6tgeneratorvk973b3beq9aczx0cg2423a22t9824k6tlatestvk973b3beq9aczx0cg2423a22t9824k6tvuevk973b3beq9aczx0cg2423a22t9824k6t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💚 Clawdis