agentmods.dev

durable-objects

durable-objects is a skill for Claude Code from butterbase-ai/butterbase-skills. It costs 41 tokens per session (2,849 once invoked), scanned B, original, MIT.

A Cloudflare Workers feature for keeping separate, persistent state for each named room, user, or agent across requests. It combines temporary in-memory data with built-in storage.

In plain words
What is it for?
Use it for chat rooms, multiplayer rooms, rate limiters, long-running agents, and leaderboards that need state to persist.
Why use it?
It avoids rebuilding state on every request and keeps one user's or room's data isolated from others.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the butterbase-skills plugin — 23 skills, 33 commands shipped together

not rated 533repo 2mo ago B scan SkillSpector: warn 41 tokens original MIT

Good fit Use it for chat rooms, multiplayer rooms, rate limiters, long-running agents, and leaderboards that need state to persist.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/butterbase-ai/butterbase-skills/durable-objects
View source ↗ butterbase-ai/butterbase-skills
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add butterbase-ai/butterbase-skills --skill durable-objects
Clone the repo
git clone --depth 1 https://github.com/butterbase-ai/butterbase-skills

Made for: Claude Code.

Or install butterbase-skills, the plugin that ships this one along with the rest of its 23 skills, 33 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for durable-objects

README.md
[![agentmods](https://agentmods.dev/badge/skills/butterbase-ai/butterbase-skills/durable-objects.svg)](https://agentmods.dev/skills/butterbase-ai/butterbase-skills/durable-objects)
Your own site
<a href="https://agentmods.dev/skills/butterbase-ai/butterbase-skills/durable-objects"><img src="https://agentmods.dev/badge/skills/butterbase-ai/butterbase-skills/durable-objects.svg" alt="Measured on agentmods" height="20"></a>
Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,849 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Data Exfiltration · line 129
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00041 $0.02849
Opus 5 $0.00020 $0.01425
Sonnet 5 $0.00008 $0.00570
Haiku 4.5 $0.00004 $0.00285

Measured 8d ago against content hash 1d2709087c88, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade B, and why

durable-objects scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

fetch("https://app.butterbase.dev/_do/chat-room/lobby", { method: "POST",

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

async fetch(req: Request): Promise<Response> {
skills/durable-objects/SKILL.md · 289 lines

How it starts

The opening of the file, as written. The whole thing — 289 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Butterbase Durable Objects

Durable Objects (DOs) are stateful per-key actors running on Cloudflare Workers. Each instance has its own in-memory state and a built-in transactional KV store. Use one when state must survive across requests for a single room/user/agent. For stateless work, use a serverless function instead (butterbase-skills:function-dev).

One tool: manage_durable_objects.

1. The mental model

Class: ChatRoom (deployed once)
   │
   ├── instance "lobby"      ─►  in-memory state + state.storage  +  WebSockets
   ├── instance "general"    ─►  separate state, separate sockets
   └── instance "user-123"   ─►  separate again

Each URL  https://<app>.butterbase.dev/_do/chat-room/<instance-id>
gets routed to the instance with that id. State is isolated per id.

A class is shared code; an instance is a unique key (/lobby, /general, /user-123). Different ids = different state. There is no shared cross-instance state.

2. Constraints (read these first)

  • One TypeScript file per class. No npm imports. Only import { ... } from 'cloudflare:workers' is allowed.
  • Exactly one exported class. export class Foo { ... } — no extra exports, no helpers re-exported.
  • PascalCase class name in source; kebab-case for the URL name (e.g. ChatRoom ↔ chat-room).
  • File size: ≤ 5 MB. Total of all DO classes per app: ≤ 10 MB compressed.
  • ≤ 5 DO classes per app (v1).
  • No service bindings yet. Functions reach DOs over HTTP, not via env binding.
  • state.storage keys/values capped at 128 KB. Larger blobs → Butterbase Storage.
  • Browser WebSockets need access_mode: "public". Browsers can't set custom headers on WS upgrade, and the _do/ dispatcher reads auth only from Authorization — ?token= and Sec-WebSocket-Protocol are silently ignored at the dispatcher (unlike the /realtime route, which does accept ?token=). Set the DO public, then read the token from ?token= (or Sec-WebSocket-Protocol) inside fetch() and verify it yourself before accepting the upgrade. Server-to-server callers can still use authenticated/service_key.

Read the full file on GitHub · 289 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 289 lines · 41 tokens per session scan B 1d2709087c88

Subscribe to this mod's changes

durable-objects is a skill published in the GitHub repository butterbase-ai/butterbase-skills (533 stars, last pushed 2mo ago), licensed MIT. It adds 41 tokens to every session and 2,849 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIsClaude CodeCloudDevOps and cloudagent-skillsai-agentsbackend-as-a-serviceclaudemcp
Related

Other skills, from other repositories

stripe-projects

Provision SaaS services + sync creds via Stripe Projects.

NousResearch/hermes-agent · 15 tokens

azure-eventhub-dotnet

Azure Event Hubs SDK for .NET. Use for high-throughput event streaming: sending events (EventHubProducerClient, EventHubBufferedProducerClient), receiving events (EventProcessorClient with checkpointing), partition management, and real-time data ingestion. Triggers: "Event Hubs", "event streaming"…

microsoft/skills · 94 tokens

azure-mgmt-botservice-dotnet

Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".

microsoft/skills · 78 tokens

django-storages-s3

Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST…

Jeffallan/claude-skills · 138 tokens

wikipedia

Search and read Wikipedia via x wkp — MediaWiki API, no API key, zero install; query, extract, suggest, and DDG route in one module. Load for wiki, wikipedia, encyclopedia lookup, article summary.

x-cmd/x-cmd · 49 tokens

cve

Look up CVE records via x cve — cached, zero-API-key, daily xz TSV. Load for cve, vulnerability id, kev, epss, nvd, cvelist, or security advisory.

x-cmd/x-cmd · 49 tokens