Arknights Operator Gacha

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:45 PM UTC
• Version: 2.0.0

Overview

This skill mostly matches its stated goal, but it automatically creates persistent OpenClaw agents from live wiki content without a review or cleanup step.

Install only if you are comfortable with a gacha request creating a durable OpenClaw agent and workspace, downloading wiki assets, committing generated files, and spawning the new agent. Review the generated SOUL.md and IDENTITY.md before using the agent, and restrict the generated agent's tools because its persona is derived from externally editable wiki pages.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:90

Finding

Untrusted Web Content Can Poison a Persistent Agent Persona

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/gacha_worker.py:145

Finding

Avatar Download Allowlist Can Be Bypassed Through HTTP Redirects

Content

View full analysis

tuple[bool, str]: """Download avatar with validation""" try: sanitized = sanitize_agent_name(agent_name) parsed = urllib.parse.urlparse(avatar_url) allowed_domains = ["static.wikia.nocookie.net", "media.prts.wiki"] if parsed.netloc not in allowed_domains or parsed.scheme != "https": return False, "Invalid avatar domain" workspace = WORKSPACE_BASE / f"workspace-{sanitized}" avatars_dir = workspace / "avatars" avatars_dir.mkdir(parents=True, exist_ok=True) avatar_path = avatars_dir / f"{sanitized}.png" resp = requests.get(avatar_url, timeout=30, stream=True) resp.raise_for_status() content_type = resp.headers.get('content-type', '') if not any(ct in content_type for ct in ['image/png', 'image/jpeg', 'image/webp']): return False, f"Invalid content type: {content_type}" downloaded = 0 MAX_SIZE = 5 * 1024 * 1024 ``` ### Technical Analysis The function validates the scheme and hostname of only the initial avatar URL. Python's `requests.get()` follows HTTP redirects by default, but the function does not validate `resp.url`, inspect redirect history, or require every redirect target to remain on an approved HTTPS host. An approved host can therefore redirect the request to a destination outside the documented allowlist. The response's declared content type and total downloaded size are checked, which limits some file-based risks, but those controls do not enforce the network destination policy. The function also trusts the server-supplied `Content-Type` without validating the downloaded file's actual signature. ### Attack Path 1. An avata ...[truncated 1296 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose frames the skill as a content-generation utility, but the workflow also creates agents, writes persistent files, downloads remote content, checks local state, and commits to git. This mismatch can mislead operators into approving or invoking the skill without realizing it performs state-changing and externally connected actions, which is a meaningful security and trust risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring says the worker outputs JSON with operator info and URLs, but the code also performs agent creation, file writes, avatar downloads, and git commits. This deceptive or misleading behavior undermines reviewability and trust, making it easier for side-effecting actions to escape scrutiny in an automation pipeline.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims to generate a random Arknights operator, but the implementation also creates local agents, writes files, downloads content, and modifies git state. That mismatch materially expands the skill's authority and creates unintended local side effects, which is dangerous in an agent environment because a seemingly harmless request can alter persistent system state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell execution, network fetches, file writes, and git operations but does not declare any explicit tool scope or permission boundaries. That makes the skill's effective capabilities opaque to reviewers and users, increasing the chance of unintended or over-privileged execution in environments that rely on manifest-level constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill is explicitly designed to create persistent agents and workspaces, which means execution leaves durable state beyond the current interaction. Persistence is not inherently malicious, but without strong disclosure, naming controls, cleanup guidance, and consent, it can clutter environments, retain unwanted artifacts, and create long-lived entities that may later be invoked unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: arknights-operator-gacha
description: Generate an Arknights operator agent based on gacha probabilities. Use when user wants to create a random Arknights character agent with authentic lore and personality.
---

# Arknights Operator Gacha

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description does not clearly warn that execution will create or modify local workspaces, download remote assets, and commit changes. Hidden side effects reduce informed consent and can lead to accidental persistence of unreviewed content or repository changes in sensitive environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require automatic language detection from the user's command and then mandate using that language for all subsequent steps. This imposes a language/locale choice without explicitly asking the user whether they want Chinese or English output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file explicitly marks it as critical to write SOUL.md in the detected language, reinforcing a forced locale policy rather than a user preference. This is a natural-language policy issue because the user is not offered a language choice or override.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Calling the external openclaw CLI to create agents gives the skill system-modifying capabilities beyond what its description suggests. In a multi-skill or semi-trusted environment, hidden agent creation increases the blast radius of simple user requests and can lead to unwanted persistence or resource sprawl.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gacha_worker.py (reported line 124)May include surrounding context.

python

try:
        sanitized = sanitize_agent_name(agent_name)
        workspace = WORKSPACE_BASE / f"workspace-{sanitized}"
        result = subprocess.run(
            ["openclaw", "agents", "add", sanitized,
             "--workspace", str(workspace), "--non-interactive"],
            capture_output=True, text=True, timeout=30, shell=False

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatically staging and committing workspace changes is not necessary to fulfill the stated gacha/operator-generation purpose and creates persistent, hard-to-notice side effects. In an agent context, this can be abused to alter repositories, pollute history, or make unreviewed changes appear legitimate.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gacha_worker.py (reported line 170)May include surrounding context.

python

try:
        sanitized = sanitize_agent_name(agent_name)
        workspace = WORKSPACE_BASE / f"workspace-{sanitized}"
        subprocess.run(["git", "add", "-A"], cwd=workspace, check=True, timeout=10)
        result = subprocess.run(
            ["git", "commit", "-m", message],
            cwd=workspace, capture_output=True, timeout=10

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gacha_worker.py (reported line 171)May include surrounding context.

python

sanitized = sanitize_agent_name(agent_name)
        workspace = WORKSPACE_BASE / f"workspace-{sanitized}"
        subprocess.run(["git", "add", "-A"], cwd=workspace, check=True, timeout=10)
        result = subprocess.run(
            ["git", "commit", "-m", message],
            cwd=workspace, capture_output=True, timeout=10
        )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script unconditionally resolves and emits a Chinese name and Chinese wiki URL for every selected operator. This is a natural-language locale choice embedded in the skill behavior, and the file does not offer the user any language preference or opt-in before doing so.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.