by 安全扫描
OpenClaw
可疑
medium confidenceInstruction-only scaffolding guide appears useful, but the skill's metadata doesn't declare required tools and the SKILL.md contains inconsistent/incorrect commands (e.g., 'uv' usage), so the package is internally inconsistent and should be verified before use.
评估建议
This skill is an instruction-only project scaffolder and has low installation risk, but there are internal inconsistencies you should resolve before using it: 1) The metadata claims no required binaries, yet the instructions call many CLIs (node/npx/npm, git, python/pip/venv, swift/Xcode). Ensure those tools exist in your environment before running any commands. 2) Fix the apparent typo 'uv init && uv pip install fastapi uvicorn' — replace with standard Python steps (for example: python -m venv ...详细分析 ▾
⚠ 用途与能力
The SKILL.md clearly expects platform toolchains (node/npx/npm, Python/pip/uvicorn, Swift/Xcode, git) and network installs, but the skill metadata declares no required binaries or environment variables. A scaffolder should list the CLIs it calls; omitting them is an incoherence. Additionally the FastAPI example uses 'uv init && uv pip install fastapi uvicorn', which is not a standard command and appears to be a typo or reference to an undeclared CLI.
ℹ 指令范围
Instructions are focused on scaffolding and include concrete shell commands (npx create-next-app, npm install, mkdir, git init/commit). They don't ask to read arbitrary files or exfiltrate data, but they do instruct performing package installs and committing to git — actions that access the network and local repo state. The 'uv' command is ambiguous/incorrect and needs correction; otherwise the scope is appropriate for a scaffolding skill.
✓ 安装机制
No install spec or code files are present (instruction-only), so there's no added install-time risk from downloads or archives being written to disk by the skill itself.
ℹ 凭证需求
The skill requests no environment variables and no credentials, which is proportionate. It does mention .env in the .gitignore and references config.py for settings, but doesn't request secrets. Users should still be aware the scaffolded projects may include instructions to use env vars and will likely cause developers to create or store secrets locally.
✓ 持久化与权限
The skill is not always-enabled and doesn't request persistent privileges. Autonomous invocation is allowed by platform default but not combined with any other high-risk factor in this package.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/29
Initial release of project-scaffold. - Provides boilerplate project structures for web apps (React/Next.js), APIs (FastAPI), mobile apps (SwiftUI), CLI tools, and browser extensions. - Includes recommended file/folder organization and relevant initialization commands for each project type. - Offers a universal .gitignore template and a post-scaffold checklist for next steps. - Guides users to ask or infer project type and then generates appropriate scaffolding.
● 无害
安装命令 点击复制
官方npx clawhub@latest install project-scaffold
镜像加速npx clawhub@latest install project-scaffold --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制