📦 Vagrant — 虚拟机管理
v1.0.0一键管理 Vagrant 虚拟机生命周期：创建、配置、启停与销毁，自动同步本地代码，统一团队开发环境，避免“在我机器能跑”问题。
0· 67·1 当前·1 累计
by 下载技能包
最后更新
2026/4/3
安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions are internally consistent with using the Membrane service to manage a 'Vagrant' connector, but there are unanswered questions about how a cloud-based connector operates on a typically local tool (Vagrant) and the skill asks you to install a global CLI that will obtain and proxy access — this mismatch and the proxy capability merit caution.
评估建议
This skill uses the Membrane service and asks you to install their global CLI and log in via a browser. Before installing, confirm with the skill author or Membrane documentation how the Vagrant connector works: specifically, does Membrane require a local agent or network access to your machine to control local Vagrant instances, or does it only target remote Vagrant-like services? Understand that the CLI will store auth tokens locally and that the `membrane request` proxy can forward arbitrary ...详细分析 ▾
ℹ 用途与能力
The skill claims to provide a Vagrant integration and all runtime instructions use the Membrane CLI and Membrane-hosted connectors. That is coherent if Membrane actually implements a Vagrant connector. However, Vagrant is normally a local/CLI VM tool without a standard network API; the SKILL.md does not explain how Membrane will reach a user's Vagrant environment (local agent, VPN, or remote service). This missing explanation is a notable gap.
ℹ 指令范围
The SKILL.md stays within a narrow scope: install the Membrane CLI, authenticate, create a connection to the Vagrant connector, list actions, run actions, or proxy requests via Membrane. It does not instruct the agent to read unrelated files or env vars. The proxy feature (membrane request) can send arbitrary requests through Membrane — useful for integrations but also a high-capability feature, so the skill should document limits and where traffic is routed.
ℹ 安装机制
No install spec in registry, but instructions tell the user to run `npm install -g @membranehq/cli`. A global npm install is a standard but privileged operation (writes to system locations). The package is from the npm registry (public) — moderate risk but expected for a CLI. There is no download from unknown hosts or archive extraction in the skill itself.
✓ 凭证需求
The skill does not request environment variables or credentials directly; it relies on Membrane's browser-based login flow. That is proportionate. However, it does not state whether the connector requires installation of a local agent or access to local Vagrant binaries/configs — if that is required, additional permissions or local access would be needed and should be declared.
✓ 持久化与权限
always:false and no declared config path/auto-enabled behavior. The skill does not request persistent elevated privileges or the ability to modify other skills. The Membrane CLI will store auth state locally as normal for CLIs, which is expected.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/3
Auto sync from membranedev/application-skills
● 无害
安装命令
点击复制官方npx clawhub@latest install vagrant
镜像加速npx clawhub@latest install vagrant --registry https://cn.longxiaskill.com