Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nginx Config Creator
v0.1.1Creates a standard Nginx/OpenResty reverse proxy config file for a service and reloads the web server. Features safety checks and environment awareness. Takes service name, domain, and port as main arguments.
⭐ 0· 1.8k·7 current·7 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the code and runtime requirements. The script actually writes an Nginx conf file and runs 'docker exec' to test and reload Nginx, so requiring 'bash' and 'docker' is appropriate.
Instruction Scope
The SKILL.md and script stay within the claimed purpose (writing a conf and reloading Nginx), but the runtime instructions permit dangerous inputs: SERVICE_NAME, DOMAIN, PORT and CONFIG_PATH are written into the filesystem without sanitization. In particular, SERVICE_NAME or CONFIG_PATH could be crafted to write outside the intended conf.d (e.g., '../' sequences or absolute paths), enabling overwrite of arbitrary files. The script also writes test output to /tmp/nginx_test_output.log. There is no validation of the container's identity beyond the provided name.
Install Mechanism
Instruction-only skill with an included shell script and no install spec — low install risk. There are no downloads or extract operations; nothing will be written to disk except when the script is explicitly run by the user/agent.
Credentials
The skill does not require credentials and only optionally reads NGINX_CONFIG_PATH and NGINX_CONTAINER_NAME from the environment (which matches its purpose). Registry metadata lists no required env vars although the README/SKILL.md recommend those two environment variables — this is a small metadata mismatch but not a high-risk issue.
Persistence & Privilege
The skill is not forced-always and does not request system-wide persistence. It does perform privileged actions when executed (writing files and running 'docker exec'), which is expected for its purpose but means it must be invoked with care. It does not modify other skill/system configs.
What to consider before installing
This skill appears to implement the stated feature, but review and run it carefully:
- Inspect the script before running and only supply trusted inputs. SERVICE_NAME and CONFIG_PATH are used directly to build the output filename, so avoid untrusted values (e.g., no '../', absolute paths, or shell metacharacters).
- Run in a safe environment first (staging) to confirm behavior and container identity; ensure the provided Docker container actually runs Nginx/OpenResty and that you have appropriate permissions.
- Because the script writes and may delete files, back up existing configs and ensure CONFIG_PATH points to the intended conf.d directory (avoid symlink surprises).
- Note the small metadata mismatch: the registry lists no required env vars but the README/SKILL.md recommend NGINX_CONFIG_PATH and NGINX_CONTAINER_NAME. If you plan to use environment variables, set them deliberately.
- Consider hardening the script (input validation, safer tempfile handling, limiting allowed paths) before using it in production.
If you need help auditing or patching the script to reject path traversal and validate inputs, I can suggest concrete modifications.Like a lobster shell, security has layers — review code before you run it.
latestvk9718y26pqsztd07z6y72j4jcs80mpqq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsbash, docker