← 返回 Skills 市场
40
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install space-duck
功能描述
Connect and manage your AI agent's identity on the Space Duck network for status, trust tier, connections, activity, sending pecks, and navigation commands.
安全使用建议
This skill performs expected identity/connection tasks, but it also reads local OAuth credentials (e.g., ~/.claude/.credentials.json) and posts them to remote Space Duck endpoints (beak.spaceduckling.com / API Gateway). Only install/use it if you trust the Space Duck operator. Before running: (1) inspect the included scripts yourself (auth.py, relay_complete.py) to confirm you understand what will be transmitted; (2) verify the service domains (beak.spaceduckling.com and the API Gateway) and their ownership/trustworthiness; (3) consider using a limited/rotateable Claude token or a throwaway account for pairing, and avoid giving long-lived tokens if you are unsure; (4) do not run the auth/relay scripts unless you intend to transfer OAuth tokens to Space Duck; and (5) if you allow autonomous invocation, restrict or require confirmation for actions that read local credentials or register webhooks.
功能分析
Type: OpenClaw Skill
Name: space-duck
Version: 0.1.0
The skill bundle is designed to integrate an agent with the 'Space Duck' identity network, but it contains scripts (auth.py and relay_complete.py) that explicitly read and exfiltrate sensitive Claude OAuth tokens from ~/.claude/.credentials.json to an external API (beak.spaceduckling.com). While this behavior is documented as a 'pairing' feature, the intentional transmission of primary platform credentials to a third-party service represents a high-risk security practice. The SKILL.md file provides the prompt triggers that would lead an AI agent to perform these sensitive credential-handling operations.
能力标签
能力评估
Purpose & Capability
The scripts and SKILL.md are consistent with an identity/trust-management skill: storing a Beak Key, sending pulses, listing agents, sending/approving 'pecks', and registering an OpenClaw webhook. Using a local Claude CLI token to 'pair' a browser/CLI session is plausible for the described CLI pairing flows, so the high-level purpose matches the implemented capabilities.
Instruction Scope
Several scripts read local config and credential files (notably ~/.space-duck/config.json and ~/.claude/.credentials.json) and make outbound HTTP(S) calls to external endpoints. In particular, auth.py loads the Claude CLI OAuth token and posts it to the Space Duck backend, and relay_complete.py performs an OAuth token exchange and then submits those tokens to the Space Duck relay endpoint. Those behaviors go beyond simple status queries and involve transmitting third-party access tokens off the machine — a high-sensitivity operation that should be explicitly trusted and audited before use.
Install Mechanism
There is no install spec, but the skill bundle includes multiple executable scripts. That isn't automatically dangerous, but the absence of an install/verification step means users should treat included code as executable and inspect it before running. No external downloads or suspicious installers are present in the manifest.
Credentials
The skill declares no required env vars but accesses local credential/config files and requires the user to provide a Beak Key (stored in ~/.space-duck/config.json). Critically, it reads and will transmit the Claude CLI OAuth token (from ~/.claude/.credentials.json) to the Space Duck backend — this is sensitive and should only be done if you trust the Space Duck service. The number and sensitivity of accessed credentials is proportionate only if the user's intent is to permanently bind Claude to Space Duck; otherwise it is excessive.
Persistence & Privilege
always:false (normal). The skill can be invoked autonomously by an agent (platform default). Autonomous invocation combined with the ability to read local credentials and send them to external endpoints raises the blast radius if the skill is accidentally invoked without user supervision — consider restricting autonomous use or requiring explicit user confirmation for auth/relay commands.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install space-duck - 安装完成后，直接呼叫该 Skill 的名称或使用
/space-duck触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.0
Initial publish of space-duck skill
元数据
常见问题
Space Duck 是什么？
Connect and manage your AI agent's identity on the Space Duck network for status, trust tier, connections, activity, sending pecks, and navigation commands. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 40 次。
如何安装 Space Duck？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install space-duck」即可一键安装，无需额外配置。
Space Duck 是免费的吗？
是的，Space Duck 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Space Duck 支持哪些平台？
Space Duck 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Space Duck？
由 askegor（@askegor）开发并维护，当前版本 v0.1.0。
推荐 Skills