← 返回 Skills 市场
80
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install sysu-duck
功能描述
中山大学校园AI陪伴鸭鸭，支持本地SQLite档案管理、多种人格设定、校园问答记忆及指令操作。
安全使用建议
Do not run this skill blindly. Key concerns: 1) The SKILL.md references src/duck.py as the actual implementation but that file is not included in the manifest — you must review src/duck.py before executing anything. 2) SKILL.md expects DUCK_USER_ID and may contact an external DUCK_YAYAID_URL (defaulting to a cloud function). Confirm what data is sent to that URL and whether it is trustworthy. 3) The skill autonomously persists user messages to a local SQLite DB (data/duck.db); decide whether you are comfortable with that storage and review retention/format. Recommended steps before installing: request the complete source (including src/duck.py and any scripts under scripts/ and assets/), inspect network calls and what is written to the DB, consider running it in a sandbox/container, and verify or override DUCK_YAYAID_URL to a controlled endpoint (or disable remote calls). If you cannot obtain and audit the referenced src/duck.py, treat the package as untrusted.
功能分析
Type: OpenClaw Skill
Name: sysu-duck
Version: 1.0.0
The 'sysu-duck' skill implements a campus AI companion that utilizes a local Python script (duck.py) to manage a SQLite database and interact with a remote cloud function (DUCK_YAYAID_URL) for ID generation. The instructions in SKILL.md direct the agent to perform web searches and store/recall data, which involves network and file system access. While these capabilities are plausibly needed for the stated purpose, the use of an external cloud endpoint for IDs and the explicit instruction to bypass platform-level environment checks (metadata.openclaw.requires) in favor of internal script handling represent risky behaviors that warrant a suspicious classification despite the lack of clear malicious intent.
能力评估
Purpose & Capability
The skill claims a local SQLite-backed campus companion (personality, memory, recall, minor web search). That purpose would legitimately need local DB access and occasional outbound search/network calls. However the registry metadata lists no required environment variables while the SKILL.md documents several (DUCK_USER_ID, DUCK_DB_PATH, DUCK_YAYAID_URL, etc.), which is an inconsistency between claimed requirements and the package metadata.
Instruction Scope
SKILL.md instructs the agent to run duck.py commands that read/write a local DB (data/duck.db), perform web searches, and call a cloud '编号服务' via DUCK_YAYAID_URL. It also permits the AI to autonomously decide to 'remember' user content (persisting user-submitted text). Those are plausible for the stated feature set, but SKILL.md says the real implementation is in src/duck.py — that file is referenced at runtime but is NOT present in the provided manifest. The provided top-level duck.py loads and immediately executes src/duck.py from disk, so the runtime behavior depends on that missing file; without it you cannot verify what network calls, data exfiltration, or filesystem operations would occur.
Install Mechanism
There is no install spec (instruction-only with a small loader script). That minimizes direct install-time risk because nothing is automatically downloaded or extracted, but runtime execution still executes a Python module from the package (src/duck.py) which must be present and audited before running.
Credentials
SKILL.md requires DUCK_USER_ID and optionally DUCK_DB_PATH and DUCK_YAYAID_URL (cloud function URL) for normal operation. The registry metadata listed no required env vars, creating a mismatch. The presence of a configurable remote endpoint (DUCK_YAYAID_URL) means the skill may call an external service by default (the doc references Tencent Cloud functions). While that can be legitimate (for obtaining a '编号'), it raises proportionality/privacy questions because the skill can autonomously persist user messages to a local DB and may send requests to an external URL — you should verify what is sent and whether that external endpoint is trustworthy.
Persistence & Privilege
The skill does not request 'always: true' and uses autonomous invocation by default (platform standard). It is expected to create and update a local SQLite DB (data/duck.db) to implement memory; this is consistent with its purpose. The main risk is that the agent is allowed to autonomously decide to write user-provided content into persistent storage and to call external endpoints to refresh IDs — this is not inherently malicious but warrants review of the missing implementation to ensure stored data and outbound traffic are handled appropriately.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install sysu-duck - 安装完成后，直接呼叫该 Skill 的名称或使用
/sysu-duck触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release
元数据
常见问题
SYSU Duck 是什么？
中山大学校园AI陪伴鸭鸭，支持本地SQLite档案管理、多种人格设定、校园问答记忆及指令操作。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 80 次。
如何安装 SYSU Duck？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install sysu-duck」即可一键安装，无需额外配置。
SYSU Duck 是免费的吗？
是的，SYSU Duck 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
SYSU Duck 支持哪些平台？
SYSU Duck 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 SYSU Duck？
由 Mars YANG（@mars2003）开发并维护，当前版本 v1.0.0。
推荐 Skills