openclaw-persona-forge
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled local Python script (
gacha.py) and a shell wrapper (gacha.sh) to provide random character generation logic. The script is transparent, uses standard libraries (secrets), and does not perform network operations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user preferences to generate
SOUL.mdandIDENTITY.mdfiles which serve as behavioral guidelines for AI agents. This creates a surface where malicious user input could potentially influence the resulting agent's instructions, though this is the core intended functionality of the skill.
Audit Metadata