技能详情（站内镜像，无评论）
作者：Zeeshan Ahmad @ainakwalamonk
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 1 · 281 · 0 current installs · 0 all-time installs
⭐ 1
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：ainakwalamonk/durable-agents
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's instructions ask the agent to discover and extract local credentials, modify user/system configs, and run recovery steps without user prompts — behavior that is plausible for local infra wiring but is disproportionate to the declared metadata and risky if run autonomously.
目的
The described goal (building Mastra + Trigger.dev pipelines) can legitimately require starting local Docker services, configuring Trigger.dev, and wiring an LLM gateway. However, the skill metadata declares no required env vars or credentials even though the runtime instructions explicitly search for and write AI credentials, Trigger secrets, and CLI PATs — a mismatch between claim and actual needs.
说明范围
The SKILL.md / setupSkill.md direct a full, non-interactive setup: scanning project directories and running docker inspect, reading/writing .env, querying Postgres via docker exec, and editing ~/Library/Preferences/trigger/default.json. It also enforces 'Never stop for user input' and 'find the solution independently' rules, which grant broad discretion to probe the host filesystem and services. Those steps go beyond typical guidance and can e…
安装机制
No install spec or remote downloads are included (instruction-only skill), which reduces supply-chain risk. The primary risk comes from the actions the instructions ask the operator/agent to perform, not from any packaged installer.
证书
Although the registry metadata lists no required env vars or credentials, the setup instructs obtaining AI_BASE_URL, AI_API_KEY, MODEL_ID, TRIGGER_SECRET_KEY, TRIGGER_ACCESS_TOKEN and possibly DB access. Asking the runtime to discover these values in other projects/containers and to write them into .env or system files is disproportionate to what's declared and increases the chance of secret exposure or accidental overwrite.
持久
The setup explicitly edits local config files (e.g., .env, trigger.config.ts, and ~/Library/Preferences/trigger/default.json), inserts tokens into the DB, and generates encrypted PATs using a hard-coded ENCRYPTION_KEY in the recovery instructions. While these changes may be needed for local self-hosting, they are privileged and should be performed with explicit user consent and review — not by a non-interactive process.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Durable Agents」。简介：Build autonomous multi-agent pipelines with Mastra (agents only) and Trigger.de…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/ainakwalamonk/durable-agents/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。