Blind Box

Virtual blind box gacha skill — pull random collectible figures with rarity tiers (Common to Limited), 5 themed series, 10-pull mode, daily free pull, and sh...

Security Scan

The skill's code, instructions, and requirements align with its stated purpose (a local virtual gacha/‘blind box’ generator); it requests no credentials, performs no network I/O, and has no install step.

Purpose & Capability

Name/description match the included code and documentation. The files implement a local, terminal-based gacha experience (series listing, single/10-pull, daily pull). No unrelated binaries, env vars, or cloud credentials are requested.

Instruction Scope

SKILL.md and the scripts give explicit presentation rules and pseudo-random algorithms for generating pulls; the skill instructs the agent to 'generate the blind box pull experience now'. This is consistent with the skill's purpose. Note: the code and SKILL.md include literal, tightly prescriptive output formats (and console messages like 'Follow these instructions EXACTLY') — this is expected for a content-generation skill but could be considered prompt-prescriptive behavior rather than arbitrary instructions to access system resources.

Install Mechanism

No install spec is present (instruction-only deployment). No downloads, package installs, or archive extraction are requested. Risk from install mechanism is minimal.

Credentials

No environment variables, credentials, or config paths are required. The scripts use only local date/time and process arguments; no secrets or external service tokens are requested.

Persistence & Privilege

always is false and the skill does not request elevated or persistent system-wide privileges. It does not attempt to modify other skills or agent configurations. Autonomous invocation is allowed (platform default) and is appropriate for this interactive content skill.

Assessment

This skill appears internally coherent and low-risk: it implements a purely local terminal gacha generator, asks for no secrets, and performs no network or file exfiltration. Before installing or running: (1) if you will execute the scripts locally, review the code (it's short and readable) to verify you are comfortable running node scripts; (2) note the skill prints prescriptive output templates and instructs the agent to follow them exactly — that's intentional for consistent output but is a form of prompt-prescriptive behavior; (3) if you need provenance/trust, verify the publisher/homepage or prefer skills from known authors. If you don't plan to run arbitrary code on a sensitive machine, this is safe to use.

Pull virtual blind boxes with a full rarity system — from Common to ultra-rare Limited editions. Five themed series, 10-pull mode, daily free pull, and beautiful shareable reveal cards.

Series

Series	Theme	Figures
🐱 猫咪日常	Daily Cat	12 figures
🚀 宇宙探险	Space Explorer	10 figures
🍜 美食精灵	Food Spirit	10 figures
🌸 四季精灵	Season Spirit	8 figures
⚔️ 古风仙侠	Wuxia	12 figures

Rarity

Rarity	Rate
⚪ 普通款 Common	55%
🔵 稀有款 Rare ★	25%
🟡 超稀有 Super Rare ★★	12%
🟠 史诗款 Epic ★★★	6%
🟣 隐藏款 Hidden ✦	1.5%
🔴 限定款 Limited ✦✦	0.5%

Commands

# Single pull (random series)
node scripts/pull.js

# Choose a series
node scripts/pull.js --series cat
node scripts/pull.js --series space
node scripts/pull.js --series food
node scripts/pull.js --series spirit
node scripts/pull.js --series wuxia

# 10-pull
node scripts/pull.js --series cat --count 10

# Daily free pull (slightly better rates)
node scripts/daily.js

# Browse all series
node scripts/series.js

# English output
node scripts/pull.js --lang en
node scripts/daily.js --lang en