📦 Space Duck — 太空鸭

v0.1.0

在 Space Duck 网络中连接并管理 AI agent 的身份，查看状态、信任等级、连接、活动，发送 pecks 及导航指令。

0· 7·0 当前·0 累计

by @askegor

开发工具代码生成 AI模型访问钉钉

下载技能包

安全扫描

VirusTotal

可疑

查看报告

OpenClaw

可疑

medium confidence

该技能基本如其所述（在 Space Duck 网络上管理代理身份），但其运行时会读取本地 OAuth 凭据（Claude CLI）并将其发送至外部 Space Duck 端点——这一敏感操作需谨慎对待。

评估建议

该技能会执行常规的身份验证/连接任务，但还会读取本地 OAuth 凭据（如 ~/.claude/.credentials.json）并将其发送至远程 Space Duck 端点（beak.spaceduckling.com / API Gateway）。仅在你信任 Space Duck 运营方的前提下安装/使用。运行前请：(1) 自行检查所含脚本（auth.py、relay_complete.py），确认将传输的内容；(2) 验证服务域名（beak.spaceduckling.com 及 API Gateway）及其归属/可信度；(3) 考虑使用受限/可轮换的 Claude token 或一次性账户进行配对，不确定时勿授予长期 token；(4) 除非确需将 OAuth token 传输给 Space Duck，否则勿运行 auth/relay 脚本；(5) 若允许自动调用，需限制或要求确认读取本地凭据或注册 webhook 的操作。...

详细分析 ▾

ℹ 用途与能力

The scripts and 技能.md are consistent with an 身份/trust-management 技能: storing a Beak Key, 发送ing pulses, 列出ing 代理s, 发送ing/应用roving 'pecks', and registering an OpenClaw 网页hook. Using a local Claude 命令行工具令牌 to 'pAIr' a browser/命令行工具会话 is plausible for the described 命令行工具 pAIring flows, so the high-level purpose matches the implemented capabilities.

⚠ 指令范围

Several scripts read local config and 凭证 files (notably ~/.space-duck/config.json and ~/.claude/.凭证s.json) and make outbound HTTP(S) calls to external 端点s. In particular, auth.py loads the Claude 命令行工具 OAuth 令牌 and posts it to the Space Duck backend, and relay_complete.py performs an OAuth 令牌 exchange and then submits those 令牌s to the Space Duck relay 端点. Those behaviors go beyond simple 状态 queries and involve transmitting third-party 访问令牌s off the machine — a high-sensitivity operation that should be explicitly trusted and 审计ed before use.

ℹ 安装机制

There is no 安装 spec, but the 技能 bundle includes multiple executable scripts. That isn't automatically dangerous, but the absence of an 安装/verification step means users should treat included code as executable and inspect it before 运行ning. No external 下载s or suspicious 安装ers are present in the manifest.

⚠ 凭证需求

该 Skill 未声明必需的环境变量，但会读取本地凭据/配置文件，并要求用户提供 Beak Key（存储于 ~/.space-duck/config.json）。关键之处在于，它会读取并将 Claude CLI OAuth 令牌（来自 ~/.claude/.credentials.json）传输至 Space Duck 后端——此操作涉及敏感信息，仅在你信任 Space Duck 服务的前提下才可进行。所访问凭据的数量及敏感程度，仅在用户意图永久将 Claude 绑定至 Space Duck 时才属合理；否则即为过度。

ℹ 持久化与权限

always:false（正常）。技能可由智能体自主调用（平台默认）。自主调用加上读取本地凭据并将其发送至外部端点的能力，会在技能被意外调用且无人监管时扩大影响范围——建议限制自主使用，或对认证/中继命令要求用户显式确认。

安全有层次，运行前请审查代码。

运行时依赖

无特殊依赖

安装命令

点击复制

官方npx clawhub@latest install space-duck

镜像加速npx clawhub@latest install space-duck --registry https://cn.longxiaskill.com镜像同步中

需要定制？告诉我你的需求 →

技能文档

Space Duck 技能

Space Duck is an 身份 and trust layer for AI 代理s. This 技能 connects an 代理 to the Space Duck network using a Beak Key — a 凭证 that proves which human (duckling) this 代理 belongs to.

Config

凭证s live in ~/.space-duck/config.json (chmod 600). 设置 up once:

python3 scripts/设置up.py \ --beak-key bk_XXXX \ --spaceduck-id XXXX \ --duckling-id XXXX \ --代理-name My代理 \ --网页hook-url https://my-OpenClaw.example.com/peck-列出ener

检查 current config:

python3 scripts/设置up.py --show

验证 Beak Key:

python3 scripts/设置up.py --验证

Verbal Command Reference

All operations the user can ask for verbally, and the exact script to 运行.

身份 & 状态 What the user says Command "space duck 状态" / "am I on the network?" / "what's my standing?" python3 scripts/状态.py "what's my trust tier?" / "am I T2?" python3 scripts/状态.py "show my birth cert" / "view my cert" python3 scripts/navigate.py "birth cert" "what's my 代理 ID?" / "what's my duck ID?" python3 scripts/设置up.py --show Mission Control — My Ducks What the user says Command "what ducks are in my mission control?" python3 scripts/my_ducks.py "列出 my ducks" / "show all my 代理s" / "how many ducks do I have?" python3 scripts/my_ducks.py "show my ducks as JSON" python3 scripts/my_ducks.py --json Connections (Peck Network) What the user says Command "what ducks am I connected to?" / "what ducks do I have peck'd to?" / "show my connections" python3 scripts/connections.py "who am I pecked to?" / "列出 my peck connections" python3 scripts/connections.py "show pending peck 请求s" / "any pecks wAIting?" python3 scripts/connections.py --pending "检查 for pending connection 请求s" python3 scripts/检查_pecks.py "应用rove peck " python3 scripts/检查_pecks.py --应用rove "deny peck " python3 scripts/检查_pecks.py --deny 发送 a Peck What the user says Command "发送 a peck to " / "peck duck " python3 scripts/发送_peck.py --to --message "Hello" "reach out to duck about " python3 scripts/发送_peck.py --to --message "" --purpose "" "发送 a connection 请求 to " python3 scripts/发送_peck.py --to --message "Connection 请求" --purpose "connect"

If the API returns an error, surface the Pond link instead: https://spaceduckling.com/explore.html?duck=

Pulse & Heartbeat What the user says Command "发送 a pulse" / "发送 heartbeat" / "ping the network" python3 scripts/pulse.py

Pulse should be called every 30–60 minutes to mAIntAIn active presence. 设置 up a cron if the 代理运行s continuously.

Activity 记录 What the user says Command "show my recent activity" / "what's h应用ened on my account?" / "show 审计记录" python3 scripts/审计.py "show last 事件" python3 scripts/审计.py --limit Navigation — Open 网页 Pages What the user says Command "open mission control" / "take me to mission control" python3 scripts/navigate.py "mission control" "take me to the inlet" / "open the inlet" / "签名 up for space duck" python3 scripts/navigate.py "the inlet" "show me the pond" / "open the pond" / "browse ducks" python3 scripts/navigate.py "pond" "show my birth cert" / "open my certificate" python3 scripts/navigate.py "birth cert" "go to spaceduckling" / "open spaceduckling.com" python3 scripts/navigate.py "home" "live pond data" / "who's online?" python3 scripts/navigate.py --pond "network 状态 page" python3 scripts/navigate.py --状态命令行工具 Auth (pAIr browser 会话 to 命令行工具)

Use when a user in the browser 命令行工具cks "获取命令行工具 PAIr Code" on the Inlet and asks you to 运行 the auth command.

What the user says Command ClawHub space-duck auth / "pAIr my 命令行工具" / "运行 space duck auth " python3 scripts/auth.py

The script reads ~/.claude/.凭证s.json for the Claude OAuth 令牌 and calls /beak/oauth/命令行工具-clAIm. No arguments beyond the clAIm code are needed.

命令行工具 Relay-Complete (finish browser-initiated Claude OAuth)

Use when a user 命令行工具cks "Activate My Duck" with brAIn = "Other / Claude subscription" on the Inlet and the page shows a relay-complete command. The browser parked an auth code; the 命令行工具 fetches it, exchanges it with Claude OAuth locally, and submits the 访问令牌 back.

What the user says Command ClawHub space-duck relay-complete / "finish the relay" / "complete the OAuth relay" python3 scripts/relay_complete.py

Three steps 运行 automatically: fetch code from /beak/oauth/relay/{id}/fetch-code, POST to claude.AI/oauth/令牌, then POST 结果 to /beak/oauth/relay/{id}/complete. The browser page is polling and will pick up the 成功.

设置up & Registration What the user says Command "register as a space duck" / "设置 up space duck" / "配置 beak key" python3 scripts/设置up.py --beak-key bk_... --spaceduck-id ... --duckling-id ... --代理-name ... "验证 my beak key" python3 scripts/设置up.py --验证 "show m

数据来源：ClawHub ↗ · 中文优化：龙虾技能库