openclaw-persona-forge
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
gacha.py) and a shell wrapper (gacha.sh) to generate randomized character attributes. These scripts use standard Python libraries and do not perform any persistent or networked actions.\n- [SAFE]: The instructions include a specific sanitization step for user-provided character names, ensuring that only safe characters (alphanumeric and hyphens) are used in temporary file paths, which mitigates potential injection and path traversal risks.\n- [SAFE]: Data handled by the skill consists primarily of character descriptions and creative writing prompts, with no evidence of sensitive data access or exfiltration.\n- [SAFE]: The skill's integration with external image generation tools is handled via instructions to use existing, reviewed platform skills, maintaining a secure trust boundary.
Audit Metadata