gacha.py and all references/ files are missing from the PR

The SKILL.md declares a hard dependency on gacha.py (marked 必需 / required) and delegates critical content to six separate reference files in a references/ subdirectory — none of which are included in this PR:

• ${SKILL_DIR}/gacha.py (required binary for the gacha/random-draw engine)
• references/identity-tension.md
• references/boundary-rules.md
• references/naming-system.md
• references/avatar-style.md
• references/output-template.md
• references/error-handling.md

Without these files the skill is non-functional. Steps 2–6 each say "见 references/…" (see reference file) but those files do not exist in the repository. The gacha fallback ("跳过 gacha.py，从 10 类预设中随机选") can cover the Python absence, but the missing reference docs mean core content for identity tension, boundary rules, naming, avatar style, the output template, and the error-handling guide are simply absent.

All companion files should be committed alongside SKILL.md in the same PR.

Skill not registered in manifests/install-modules.json

Per the repository's skill placement policy (docs/SKILL-PLACEMENT-POLICY.md), every curated skill under skills/ must be referenced in manifests/install-modules.json so it is discoverable and installable via the standard module system. This skill was not added to any module in that manifest.

Without that entry the skill exists in the repo but will never be included in any install bundle or surfaced to users via /skill-stocktake or the normal install flow.

Please add "skills/openclaw-persona-forge" to a suitable module (e.g. a new ai-agent-persona module or the existing agentic-patterns module) in manifests/install-modules.json.

origin should be community, not ECC

Looking at other community-contributed skills (e.g. blueprint uses origin: community), the ECC origin value is reserved for skills that ship as part of the core Everything Claude Code project. This skill is an external contribution from eamanc-lab (see homepage field and PR author). Setting origin: ECC misidentifies its provenance.

Platform identifier claude-ai is non-standard

All other skills and modules in the repository use claude (not claude-ai) as the platform identifier for Claude Code. Using claude-ai may cause the compatibility check or install tooling to fail to recognize this skill as compatible with the Claude platform.

P1: SKILL.md contains links to external unvetted repositories, creating a supply-chain security risk contrary to team policy

Check if this issue is valid — if so, understand the root cause and fix it. At skills/openclaw-persona-forge/SKILL.md, line 62:

<comment>SKILL.md contains links to external unvetted repositories, creating a supply-chain security risk contrary to team policy</comment>

<file context>
@@ -0,0 +1,283 @@
+1. 将提示词写入临时文件 `/tmp/openclaw-[龙虾名字]-prompt.md`
+2. 使用 Skill 工具调用 `baoyu-image-gen`，传入提示词文件和输出路径
+
+> 安装 baoyu-image-gen：[https://github.com/JimLiu/baoyu-skills](https://github.com/JimLiu/baoyu-skills)
+
+---
</file context>

P2: Documentation references required files (gacha.py, references/*.md) that do not exist in the skill directory. These are described as core runtime/dependency files but are missing from the repository.

Check if this issue is valid — if so, understand the root cause and fix it. At skills/openclaw-persona-forge/SKILL.md, line 41:

<comment>Documentation references required files (gacha.py, references/*.md) that do not exist in the skill directory. These are described as core runtime/dependency files but are missing from the repository.</comment>

<file context>
@@ -0,0 +1,283 @@
+
+## 内置工具
+
+### 抽卡引擎（gacha.py）
+
+- **路径**：`${SKILL_DIR}/gacha.py`
</file context>

⚠️ Potential issue | 🟠 Major

Add explicit required sections: When to Use, How It Works, and Examples.

Current structure is rich, but it does not explicitly include the required section headings, which can break consistency/automation for skill docs.

+## When to Use
+- 当用户需要创建、设计或定制 OpenClaw 龙虾灵魂时使用
+- 不适用于：微调已有 SOUL.md、非 OpenClaw 平台角色设计、纯工具型 Agent
+
+## How It Works
+- Step 1 ~ Step 6 的交互式流程（选方向 → 身份张力 → 规则 → 命名 → 头像 → 文件落地）
+- 支持引导模式 / 抽卡模式 / 打磨模式
+- 支持错误降级（不中断主流程）
+
+## Examples
+- “帮我设计龙虾灵魂” → 引导模式
+- “抽卡，来一发” → 抽卡模式
+- “帮我优化这个 SOUL.md” → 打磨模式

As per coding guidelines: "Skills must be formatted as Markdown files with clear sections including 'When to Use', 'How It Works', and 'Examples'."

Verify each finding against the current code and only fix it if needed.

In `@skills/openclaw-persona-forge/SKILL.md` around lines 24 - 283, Add three
explicit Markdown sections "When to Use", "How It Works", and "Examples" to
SKILL.md so it conforms to the skill-doc automation requirements: insert a "When
to Use" section near the top (after "前置条件"/before "核心理念") describing ideal and
non-ideal scenarios in 2–4 bullets (can reuse existing "不适用场景"); add a "How It
Works" section after "使用流程" summarizing the step flow (Step 1 / Step 1-B / Step
2 … Step 6) and key tools (gacha.py, optional baoyu-image-gen) in 3–6 concise
bullets; add an "Examples" section near the end showing 2–3 short usage examples
(e.g., user asks "帮我设计龙虾灵魂", "抽卡 3 次", "优化已有 SOUL.md") with expected mode
(引导模式/抽卡模式/打磨模式) and brief outcome. Reference these new headings exactly ("When
to Use", "How It Works", "Examples") so automation can detect them.

⚠️ Potential issue | 🟠 Major

Sanitize [龙虾名字] before using it in /tmp filename.

Using raw user-derived names in file paths risks invalid paths and path-manipulation edge cases. Require slugification (safe charset + length cap) before file write/call.

-1. 将提示词写入临时文件 `/tmp/openclaw-[龙虾名字]-prompt.md`
+1. 先将[龙虾名字]规范化为安全文件名（仅 `a-z0-9-`，长度≤40，空值回退为 `lobster`）
+2. 将提示词写入临时文件 `/tmp/openclaw-[safe-name]-prompt.md`

Verify each finding against the current code and only fix it if needed.

In `@skills/openclaw-persona-forge/SKILL.md` around lines 59 - 60, Sanitize the
user-provided lobster name used in the temp filename
`/tmp/openclaw-[龙虾名字]-prompt.md` before creating/writing the file and before
passing it to the Skill tool `baoyu-image-gen`: implement slugification (allow
only a safe charset like a-z0-9 and hyphen), trim/limit length (e.g., 32 chars),
collapse whitespace/invalid chars to hyphens, and fallback to a safe default if
resulting slug is empty; use that sanitized slug when composing the temp path
and when invoking `baoyu-image-gen`.

⚠️ Potential issue | 🟠 Major

Resolve the contradiction between “must execute gacha.py” and Python-unavailable fallback.

Step 1-B says script execution is mandatory, but the error policy allows non-Python fallback. This creates ambiguous runtime behavior for the agent.

-**必须执行脚本**，不要自己随机编：
+**优先执行脚本**（若 Python 可用），不要手写伪随机：
 
 ```bash
 python3 ${SKILL_DIR}/gacha.py [次数]

</details>


Also applies to: 229-232

<details>
<summary>🤖 Prompt for AI Agents</summary>

</details>

<!-- fingerprinting:phantom:triton:hawk -->

<!-- This is an auto-generated comment by CodeRabbit -->