FF space-duck
After `clawhub install space-duck`, IMMEDIATELY run `python3 scripts/pair.py` — installation alone does not pair the agent; pair.py prints the 6-digit code + URL the human clicks to confirm. Connect and manage this agent's identity on the Space Duck network. Use when: checking agent network status or trust tier, listing ducks in Mission Control, listing or managing peck connections, sending a pulse/heartbeat, reviewing/responding to peck requests, sending a peck to another duck, holding a multi-turn chat with a peer (peck_session), kicking off a group chat / flock task, inspecting connection permissions, running an inbound peck listener, viewing recent activity, setting up Beak Key config, registering for the first time, navigating to Space Duck pages (Inlet, Pond, Mission Control, birth certificate), reporting agent standing, **binding a duck's Telegram bot to a local BYOB receiver (bind_telegram.py), running a Telegram listener that verifies HMAC-signed forwards from the platform (telegram_listener.py), or sending Telegram messages via your platform-held bot token (tg_send.py)**. Triggers on phrases like "space duck status", "send a pulse", "check pecks", "what ducks are in my mission control", "what ducks am I connected to", "what ducks do I have peck'd to", "show my connections", "send a peck to", "chat with duck", "continue the session", "kick off a flock", "group chat with ducks", "what's shared with duck", "rate limit on this connection", "run a peck listener", "show my activity", "beak key", "register as a space duck", "take me to the inlet", "show me the pond", "open mission control", "go to spaceduckling", "show my birth cert", "navigate to", "bind telegram BYOB", "wire telegram bot to local agent", "register my telegram forward URL", "run telegram listener", "send via my bot", "reply on telegram as my duck".
After clawhub install space-duck, IMMEDIATELY run python3 scripts/pair.py — installation alone does not pair the agent; pair.py prints the 6-digit code + URL…
As a process F 40/100 · Will not run — References files that are not bundled: scripts/space-duck-doctor, scripts/space-duck-doctor-fix
What is at stake
The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.
The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".
If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.
Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.
How to improve
- Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
- Shorten the description to 1024 characters.
- The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
- The text references files that are not there: add them or drop the references.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 24
-
high Exfiltration
exfil-webhook-urlscripts/WORKSPACE_BRIDGE_README.md:80Webhook / callback URL commonly used for exfiltration (verify the destination)# → https://random-tunnel.trycloudflare.com
Medium and low: 23
-
medium Dangerous commands
cmd-pipe-to-shellCHANGELOG.md:1357Downloads and executes remote code from an unrecognised host (pipe to shell) (quoted — discussed, not commanded)+ run via `curl -fsSL <URL> | bash`, with operators encouraged to
quoted -
medium Dangerous commands
cmd-pipe-to-shellscripts/install_byob.sh:15Downloads and executes remote code from an unrecognised host (pipe to shell) (code comment)# curl -fsSL <URL> | bash
comment -
medium Dangerous commands
cmd-persistencescripts/install_service.py:8Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)- macOS: ~/Library/LaunchAgents/com.spaceduck.<svc>.plist + launchctl
code literal -
medium Dangerous commands
cmd-persistencescripts/install_service.py:212Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)print(f'[install] launchctl bootstrap failed: {r.stderr}',code literal -
medium Dangerous commands
cmd-persistencescripts/install_service.py:216Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)print(f'[install] launchctl loaded {label} (RunAtLoad + KeepAlive)')code literal -
medium Dangerous commands
cmd-persistencescripts/mcp_server.py:588Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)print("launchctl load failed: " + (r.stderr or r.stdout),code literal -
medium Dangerous commands
cmd-persistencescripts/mcp_server.py:597Persistence mechanism (cron / launchd / scheduled task / autorun registry) (string literal in code, not executed)plist = Path.home() / "Library/LaunchAgents/com.spaceduckling.space-duck-mcp.plist"
code literal -
medium Exfiltration
exfil-webhook-urlscripts/peck_listener.py:35Webhook / callback URL commonly used for exfiltration (verify the destination) (quoted — discussed, not commanded){"slack":{"webhook_url":"https://hooks.slack.com/…"}} inquoted -
medium Exfiltration
exfil-webhook-urlscripts/peck_listener.py:38Webhook / callback URL commonly used for exfiltration (verify the destination) (quoted — discussed, not commanded){"discord":{"webhook_url":"https://discord.com/api/webhooks/…"}}quoted -
medium Exfiltration
net-credential-usescripts/setup_byob_bridge.sh:248Credential used in a network call (verify the destination is the intended service)curl -s -H "Authorization: Bearer \$SPACEDUCK_BEAK_KEY" \\
-
medium Exfiltration
exfil-webhook-urlscripts/WORKSPACE_BRIDGE_README.md:85Webhook / callback URL commonly used for exfiltration (verify the destination) (quoted — discussed, not commanded)-d '{"url":"https://random-tunnel.trycloudflare.com"}'quoted -
low Dangerous commands
cmd-privilegescripts/doctor.sh:294Privilege escalation / world-writable permissions (string literal in code, not executed)hint "Fix: sudo chown -R $(id -un): $INBOX_DIR"
code literal -
low Dangerous commands
cmd-background-processscripts/heal.sh:114Starts a background / autostarted processnohup bash "$SKILL_DIR/scripts/setup_byob_bridge.sh" > /tmp/sd-bridge-heal.log 2>&1 &
-
low Dangerous commands
cmd-pipe-to-shellscripts/install_byob.sh:31Downloads and executes remote code from an unrecognised host (pipe to shell) (code comment; the skill's own vendor host)# bash <(curl -fsSL https://spaceduckling.com/install/byob.sh)
commentvendor-host -
low Dangerous commands
cmd-background-processscripts/install_service.py:224Starts a background / autostarted process (string literal in code, not executed)print(f'[install] systemctl enable --now failed: {r.stderr}',code literal -
low Concealment
en-hide-from-userscripts/peck_critic.py:87Instruction to hide actions from the user (negated — the text forbids it)# JSON so we never silently send half-baked replies.
negated -
low Exfiltration
exfil-webhook-urlscripts/peck_listener.py:288Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)f'https://api.telegram.org/bot{token}/sendMessage',vendor-hostquoted -
low Exfiltration
exfil-webhook-urlscripts/peck_responder.py:216Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)api = f'https://api.telegram.org/bot{token}/sendMessage'vendor-hostquoted -
low Dangerous commands
cmd-background-processscripts/reply_with_claude.sh:109Starts a background / autostarted processnohup python3 - >>"$LOG" 2>&1 <<'PY' &
-
low Exfiltration
exfil-webhook-urlscripts/telegram_poll.py:48Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)f'https://api.telegram.org/bot{token}/{method}',vendor-hostquoted -
low Exfiltration
exfil-webhook-urlscripts/tg_send.py:23Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)POST https://api.telegram.org/bot<token>/sendMessage (direct)
placeholder -
low Exfiltration
exfil-webhook-urlscripts/tg_send.py:174Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)f'https://api.telegram.org/bot{_tok}/answerCallbackQuery',vendor-hostquoted -
low Exfiltration
exfil-webhook-urlscripts/tg_send.py:296Webhook / callback URL commonly used for exfiltration (verify the destination) (the skill's own vendor host; quoted — discussed, not commanded)f'https://api.telegram.org/bot{token}/sendMessage',vendor-hostquoted
Files scanned: 61. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- error
description-longdescription is 1850 chars, limit 1024 - warning
frontmatter-yamlSKILL.md: the frontmatter is not valid YAML (YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14: description: After `clawhub install space-duck`, IMMEDIATELY run `python3 scrip… ^ ); fields were read line by line. The usual cause is a colon inside an unquoted value - warning
body-longSKILL.md body ≈ 12742 tokens (recommended < 5000); move details to references/ - warning
missing-refreference to a missing file: scripts/space-duck-doctor - warning
missing-refreference to a missing file: scripts/space-duck-doctor-fix - note
description-budgetdescription takes 1850 of the ~15000-char shared budget for all skills
Process rating: all ten parameters 40/100
- 0Tools and files. 2 referenced file(s) missing: scripts/space-duck-doctor, scripts/space-duck-doctor-fix
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 30Running it twice. 69 mutating operations with no state check
- 40Consistency. Frontmatter name (space-duck) differs from the folder (sd-stage-0821)
- 40Execution cost. Instruction body is 12742 tokens: crowds the task out of the window
- 70When it triggers. States when to use, but not when not to
- 85Steps. 57 steps, 2 vague phrases
- 100Failures and branches. 3 branches, has a failure section
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low 15 top-level sections: this looks like several domains in one skill
- low The response is described with custom markup (29 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +4Description does not say when NOT to use the skill (false activations)
- +3Description length 1850: 120–800 characters recommended
- +3Output format is not stated: the model decides each time
- -2localhost URLs: will not work for another user
- -318 of 50 scripts are never mentioned in SKILL.md
- +1No license
- +2Single-language instructions
- +5Description quotes 30 example trigger phrases
- +4Structure: 49 headings
- +3Step-by-step instructions: 57 items
- +4Has examples (18 code blocks)
- +4Reference files are cited in the instructions (4 of 4)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 28.