构建自主编码 Agent 的模式库：基于 AAS autonomous-agent-patterns 技能的实战指南-平芜编程栈

AI 技能
AI 插件
人工智能

【免费下载链接】agentic-awesome-skills

AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

项目地址：https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills

点击查看免费下载

本文围绕 agentic-awesome-skills 仓库中autonomous-agent-patterns技能（根技能定义见 SKILL.md，完整程序与参考材料见详细指南）展开，系统讲解设计自主编码 Agent 所需的六大核心模式：Agent 循环、多模型架构、工具设计、权限与安全、浏览器自动化、上下文管理与 MCP 集成。读完本文，你将能够照着可复制的代码骨架，搭建一个具备工具调用、审批机制、沙箱隔离、断点恢复能力的自主编码 Agent，并将其接入仓库技能体系进行组合使用。

在 agentic-awesome-skills 仓库中，autonomous-agent-patterns被收录于 catalog.json，归类为ai-ml类别、critical风险等级，标签为autonomous、agent，触发词覆盖 "building coding agents" 等常见表述——这意味着当用户提出构建自主编码 Agent 的需求时，该技能会被 Agent 自动激活。该技能以 Cline 与 OpenAI Codex 为设计灵感来源，与仓库内兄弟技能 autonomous-agents（侧重 ReAct、Plan-Execute、Reflection 等推理模式与可靠性原则）互为补充：前者提供"如何实现"的工程骨架，后者提供"如何设计"的原则约束。

1. 核心 Agent 架构

1.1 Agent 循环（Agent Loop）

所有自主 Agent 的本质都是一个循环：思考（Think）→ 决策（Decide）→ 执行（Act）→ 观察（Observe），循环往复直到任务完成或达到迭代上限。

┌─────────────────────────────────────────────────────────────┐ │ AGENT LOOP │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ Think │───▶│ Decide │───▶│ Act │ │ │ │ (Reason) │ │ (Plan) │ │ (Execute)│ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ ▲ │ │ │ │ ┌──────────┐ │ │ │ └─────────│ Observe │◀─────────┘ │ │ │ (Result) │ │ │ └──────────┘ │ └─────────────────────────────────────────────────────────────┘

详细指南给出了一份可直接运行的最小实现。其关键设计点在于：

循环终止条件：LLM 返回tool_calls时持续执行工具，不再返回工具调用时即视为任务完成；若达到max_iterations仍未收敛，则返回 "Max iterations reached" 防止失控。详细指南中的默认值为 50 次迭代。
历史即状态：整个history列表同时承担对话上下文与工具结果回传两个职责，role: "tool"的消息通过tool_call_id与对应的工具调用建立关联，这是 OpenAI 风格工具调用协议的标准写法。
工具注册表：self.tools = {t.name: t for t in tools}以工具名为键建立索引，_execute_tool内部通过json.loads(tool_call.arguments)解析参数并动态调用。

class AgentLoop: def __init__(self, llm, tools, max_iterations=50): self.llm = llm self.tools = {t.name: t for t in tools} self.max_iterations = max_iterations self.history = [] def run(self, task: str) -> str: self.history.append({"role": "user", "content": task}) for i in range(self.max_iterations): # Think: Get LLM response with tool options response = self.llm.chat( messages=self.history, tools=self._format_tools(), tool_choice="auto" ) # Decide: Check if agent wants to use a tool if response.tool_calls: for tool_call in response.tool_calls: # Act: Execute the tool result = self._execute_tool(tool_call) # Observe: Add result to history self.history.append({ "role": "tool", "tool_call_id": tool_call.id, "content": str(result) }) else: # No more tool calls = task complete return response.content return "Max iterations reached" def _execute_tool(self, tool_call) -> Any: tool = self.tools[tool_call.name] args = json.loads(tool_call.arguments) return tool.execute(**args)

从仓库兄弟技能 autonomous-agents 详细指南可以印证该循环背后的设计动机：ReAct 模式（Thought → Action → Observation 交替）是现代 Agent 的基础，而"显式推理轨迹让调试成为可能"是必须坚持的原则——因此实现中不应把推理过程吞掉，而应像上述代码一样把每一步思考与工具结果都写入history，保证可审计、可回放。

1.2 多模型架构（Multi-Model Architecture）

自主编码 Agent 不必所有环节共用同一个模型。详细指南建议按任务类型差异化选型：快速模型负责计划、强大模型负责复杂推理、专门模型负责代码生成。

class MultiModelAgent: """ Use different models for different purposes: - Fast model for planning - Powerful model for complex reasoning - Specialized model for code generation """ def __init__(self): self.models = { "fast": "gpt-3.5-turbo", # Quick decisions "smart": "gpt-4-turbo", # Complex reasoning "code": "claude-3-sonnet", # Code generation } def select_model(self, task_type: str) -> str: if task_type == "planning": return self.models["fast"] elif task_type == "analysis": return self.models["smart"] elif task_type == "code": return self.models["code"] return self.models["smart"]

说明两点：

上述模型名仅为示例占位，实际接入时以你环境中可用的模型为准；模式的本质是"按任务类型建立模型路由表"，将task_type到模型标识的映射做成配置，便于替换与成本控制。
该模式与仓库内Multi-Model类技能的思路一致：不是追求单一模型"全知全能"，而是把便宜快速的模型用在高频低风险环节，把昂贵强模型用在低频高风险环节。

2. 工具设计模式（Tool Design Patterns）

2.1 工具 Schema 与基类

每个工具都应暴露标准的 JSON Schema 描述（名称、说明、参数、必填项），供 LLM 理解并生成调用。详细指南给出了Tool基类与ReadFileTool的完整实现：

class Tool: """Base class for agent tools""" @property def schema(self) -> dict: """JSON Schema for the tool""" return { "name": self.name, "description": self.description, "parameters": { "type": "object", "properties": self._get_parameters(), "required": self._get_required() } } def execute(self, **kwargs) -> ToolResult: """Execute the tool and return result""" raise NotImplementedError class ReadFileTool(Tool): name = "read_file" description = "Read the contents of a file from the filesystem" def _get_parameters(self): return { "path": { "type": "string", "description": "Absolute path to the file" }, "start_line": { "type": "integer", "description": "Line to start reading from (1-indexed)" }, "end_line": { "type": "integer", "description": "Line to stop reading at (inclusive)" } } def _get_required(self): return ["path"] def execute(self, path: str, start_line: int = None, end_line: int = None) -> ToolResult: try: with open(path, 'r') as f: lines = f.readlines() if start_line and end_line: lines = lines[start_line-1:end_line] return ToolResult( success=True, output="".join(lines) ) except FileNotFoundError: return ToolResult( success=False, error=f"File not found: {path}" )

设计要点：

统一的ToolResult返回值：无论成功失败都返回结构化结果（success/output/error），LLM 才能可靠地根据观察决定下一步。
参数描述必须面向模型：description字段是给模型读的，写得越明确（如 "Line to start reading from (1-indexed)"），模型生成的参数越准确。
异常也要结构化：捕获FileNotFoundError并返回success=False，而不是抛异常中断循环——Agent 循环要求每一步都必须有可观察的返回。

2.2 编码 Agent 的必备工具清单

详细指南用一张映射表给出了一个编码 Agent 的完整工具面：

CODING_AGENT_TOOLS = { # File operations "read_file": "Read file contents", "write_file": "Create or overwrite a file", "edit_file": "Make targeted edits to a file", "list_directory": "List files and folders", "search_files": "Search for files by pattern", # Code understanding "search_code": "Search for code patterns (grep)", "get_definition": "Find function/class definition", "get_references": "Find all references to a symbol", # Terminal "run_command": "Execute a shell command", "read_output": "Read command output", "send_input": "Send input to running command", # Browser (optional) "open_browser": "Open URL in browser", "click_element": "Click on page element", "type_text": "Type text into input", "screenshot": "Capture screenshot", # Context "ask_user": "Ask the user a question", "search_web": "Search the web for information" }

这张清单的划分逻辑值得借鉴：文件操作 → 代码理解 → 终端执行 → 浏览器（可选）→ 上下文。其中ask_user与search_web属于"上下文类"工具——前者实现人机交互，后者实现外部信息获取，两者都是提升 Agent 鲁棒性的关键补充。

2.3 编辑工具设计：精确替换 + 冲突检测

直接整文件覆写极易破坏用户代码，因此详细指南专门给出了EditFileTool：采用search/replace 精确替换，并通过expected_occurrences做冲突校验——只有待替换文本出现次数与预期一致时才执行写入，否则拒绝修改并返回错误。

class EditFileTool(Tool): """ Precise file editing with conflict detection. Uses search/replace pattern for reliable edits. """ name = "edit_file" description = "Edit a file by replacing specific content" def execute( self, path: str, search: str, replace: str, expected_occurrences: int = 1 ) -> ToolResult: """ Args: path: File to edit search: Exact text to find (must match exactly, including whitespace) replace: Text to replace with expected_occurrences: How many times search should appear (validation) """ with open(path, 'r') as f: content = f.read() # Validate actual_occurrences = content.count(search) if actual_occurrences != expected_occurrences: return ToolResult( success=False, error=f"Expected {expected_occurrences} occurrences, found {actual_occurrences}" ) if actual_occurrences == 0: return ToolResult( success=False, error="Search text not found in file" ) # Apply edit new_content = content.replace(search, replace) with open(path, 'w') as f: f.write(new_content) return ToolResult( success=True, output=f"Replaced {actual_occurrences} occurrence(s)" )

这一模式是 Cline 等主流编码 Agent 的核心可靠性手段：先验证再写入。content.count(search)的精确匹配（含空白字符）保证了不会误改相似文本；期望出现次数默认 1，当代码中存在多处相同片段时强制显式声明，从机制上避免"批量误替换"。

3. 权限与安全模式（Permission & Safety Patterns）

3.1 四级权限模型

自主 Agent 必须对工具调用实施分级授权。详细指南定义了AUTO / ASK_ONCE / ASK_EACH / NEVER四级权限，并将工具按风险归类：

class PermissionLevel(Enum): # Fully automatic - no user approval needed AUTO = "auto" # Ask once per session ASK_ONCE = "ask_once" # Ask every time ASK_EACH = "ask_each" # Never allow NEVER = "never" PERMISSION_CONFIG = { # Low risk - can auto-approve "read_file": PermissionLevel.AUTO, "list_directory": PermissionLevel.AUTO, "search_code": PermissionLevel.AUTO, # Medium risk - ask once "write_file": PermissionLevel.ASK_ONCE, "edit_file": PermissionLevel.ASK_ONCE, # High risk - ask each time "run_command": PermissionLevel.ASK_EACH, "delete_file": PermissionLevel.ASK_EACH, # Dangerous - never auto-approve "sudo_command": PermissionLevel.NEVER, "format_disk": PermissionLevel.NEVER }

分级原则一目了然：只读操作自动放行（AUTO）；写操作会话内询问一次（ASK_ONCE）；命令执行与删除每次询问（ASK_EACH）；毁灭性操作永不允许（NEVER）。该设计同时解决了"效率"与"安全"的矛盾——既不打断高频安全的读取，也不放过高风险操作。

3.2 审批管理器与动态风险评级

仅仅按工具静态分级还不够，ApprovalManager进一步引入了基于参数的动态风险评级：同一个run_command工具，执行ls与执行rm -rf的风险完全不同，需要在审批时逐次评估。

class ApprovalManager: def __init__(self, ui, config): self.ui = ui self.config = config self.session_approvals = {} def request_approval(self, tool_name: str, args: dict) -> bool: level = self.config.get(tool_name, PermissionLevel.ASK_EACH) if level == PermissionLevel.AUTO: return True if level == PermissionLevel.NEVER: self.ui.show_error(f"Tool '{tool_name}' is not allowed") return False if level == PermissionLevel.ASK_ONCE: if tool_name in self.session_approvals: return self.session_approvals[tool_name] # Show approval dialog approved = self.ui.show_approval_dialog( tool=tool_name, args=args, risk_level=self._assess_risk(tool_name, args) ) if level == PermissionLevel.ASK_ONCE: self.session_approvals[tool_name] = approved return approved def _assess_risk(self, tool_name: str, args: dict) -> str: """Analyze specific call for risk level""" if tool_name == "run_command": cmd = args.get("command", "") if any(danger in cmd for danger in ["rm -rf", "sudo", "chmod"]): return "HIGH" return "MEDIUM"

要点：

会话级记忆：session_approvals字典让ASK_ONCE的授权在单次会话内生效，避免重复打扰。
风险关键词黑名单：_assess_risk通过检测rm -rf、sudo、chmod等危险片段将命令升级为HIGH风险，触发更严格的审批展示。

3.3 沙箱化执行（Sandboxing）

即使有审批，未经验证的第三方代码也不该直接运行在宿主环境。SandboxedExecution提供了一层轻量隔离：命令白名单 + 路径白名单 + 环境隔离。

class SandboxedExecution: """ Execute code/commands in isolated environment """ def __init__(self, workspace_dir: str): self.workspace = workspace_dir self.allowed_commands = ["npm", "python", "node", "git", "ls", "cat"] self.blocked_paths = ["/etc", "/usr", "/bin", os.path.expanduser("~")] def validate_path(self, path: str) -> bool: """Ensure path is within workspace""" real_path = os.path.realpath(path) workspace_real = os.path.realpath(self.workspace) return real_path.startswith(workspace_real) def validate_command(self, command: str) -> bool: """Check if command is allowed""" cmd_parts = shlex.split(command) if not cmd_parts: return False base_cmd = cmd_parts[0] return base_cmd in self.allowed_commands def execute_sandboxed(self, command: str) -> ToolResult: if not self.validate_command(command): return ToolResult( success=False, error=f"Command not allowed: {command}" ) # Execute in isolated environment result = subprocess.run( command, shell=True, cwd=self.workspace, capture_output=True, timeout=30, env={ **os.environ, "HOME": self.workspace, # Isolate home directory } ) return ToolResult( success=result.returncode == 0, output=result.stdout.decode(), error=result.stderr.decode() if result.returncode != 0 else None )

安全细节：

真实路径校验：os.path.realpath解析符号链接后判断是否位于工作区之内，可绕过..路径穿越。
命令白名单 +shlex.split：先分词取可执行文件主名再校验，避免python -c "...恶意..."一类通过参数混入的危险；allowed_commands可按项目实际需要裁剪。
超时与 HOME 隔离：timeout=30防止失控进程挂死；把HOME指向工作区，使未信任命令无法访问用户真实主目录。

4. 浏览器自动化（Browser Automation）

4.1 浏览器工具模式

现代编码 Agent 常需要验证前端效果或抓取页面状态。详细指南基于 Playwright/Puppeteer 给出了浏览器工具实现：每次关键操作（打开、点击）后自动截图并回传，让 Agent 具备"视觉观察"能力。

class BrowserTool: """ Browser automation for agents using Playwright/Puppeteer. Enables visual debugging and web testing. """ def __init__(self, headless: bool = True): self.browser = None self.page = None self.headless = headless async def open_url(self, url: str) -> ToolResult: """Navigate to URL and return page info""" if not self.browser: self.browser = await playwright.chromium.launch(headless=self.headless) self.page = await self.browser.new_page() await self.page.goto(url) # Capture state screenshot = await self.page.screenshot(type='png') title = await self.page.title() return ToolResult( success=True, output=f"Loaded: {title}", metadata={ "screenshot": base64.b64encode(screenshot).decode(), "url": self.page.url } ) async def click(self, selector: str) -> ToolResult: """Click on an element""" try: await self.page.click(selector, timeout=5000) await self.page.wait_for_load_state("networkidle") screenshot = await self.page.screenshot() return ToolResult( success=True, output=f"Clicked: {selector}", metadata={"screenshot": base64.b64encode(screenshot).decode()} ) except TimeoutError: return ToolResult( success=False, error=f"Element not found: {selector}" ) async def type_text(self, selector: str, text: str) -> ToolResult: """Type text into an input""" await self.page.fill(selector, text) return ToolResult(success=True, output=f"Typed into {selector}") async def get_page_content(self) -> ToolResult: """Get accessible text content of the page""" content = await self.page.evaluate(""" () => { // Get visible text const walker = document.createTreeWalker( document.body, NodeFilter.SHOW_TEXT, null, false ); let text = ''; while (walker.nextNode()) { const node = walker.currentNode; if (node.textContent.trim()) { text += node.textContent.trim() + '\\n'; } } return text; } """) return ToolResult(success=True, output=content)

实践要点：

截图回传：metadata中携带 base64 编码的截图，为后面"视觉 Agent"模式铺路。
等待网络空闲：点击后wait_for_load_state("networkidle")确保 SPA 渲染完成再截图，避免截到中间态。
超时即失败：元素 5 秒内不可见就返回结构化错误，而不是长时间挂起。

4.2 视觉 Agent 模式

当页面元素没有稳定的 CSS 选择器时，可以退化为"视觉驱动"：把截图交给多模态 LLM，让它描述页面、甚至直接返回目标元素的近似坐标，再用鼠标坐标点击。

class VisualAgent: """ Agent that uses screenshots to understand web pages. Can identify elements visually without selectors. """ def __init__(self, llm, browser): self.llm = llm self.browser = browser async def describe_page(self) -> str: """Use vision model to describe current page""" screenshot = await self.browser.screenshot() response = self.llm.chat([ { "role": "user", "content": [ {"type": "text", "text": "Describe this webpage. List all interactive elements you see."}, {"type": "image", "data": screenshot} ] } ]) return response.content async def find_and_click(self, description: str) -> ToolResult: """Find element by visual description and click it""" screenshot = await self.browser.screenshot() # Ask vision model to find element response = self.llm.chat([ { "role": "user", "content": [ { "type": "text", "text": f""" Find the element matching: "{description}" Return the approximate coordinates as JSON: {{"x": number, "y": number}} """ }, {"type": "image", "data": screenshot} ] } ]) coords = json.loads(response.content) await self.browser.page.mouse.click(coords["x"], coords["y"]) return ToolResult(success=True, output=f"Clicked at ({coords['x']}, {coords['y']})")

该模式的代价与收益同样明显：选择器方案更稳定，视觉方案更通用。工程上建议"先选择器、后视觉"的降级策略——DOM 方案失败时再回退到截图 + 坐标。

5. 上下文管理（Context Management）

5.1 上下文注入模式：@-mention 风格

编码 Agent 需要高效地把"文件、文件夹、URL、IDE 诊断"注入提示词。详细指南借鉴 Cline 的@提及模式实现了ContextManager：

class ContextManager: """ Manage context provided to the agent. Inspired by Cline's @-mention patterns. """ def __init__(self, workspace: str): self.workspace = workspace self.context = [] def add_file(self, path: str) -> None: """@file - Add file contents to context""" with open(path, 'r') as f: content = f.read() self.context.append({ "type": "file", "path": path, "content": content }) def add_folder(self, path: str, max_files: int = 20) -> None: """@folder - Add all files in folder""" for root, dirs, files in os.walk(path): for file in files[:max_files]: file_path = os.path.join(root, file) self.add_file(file_path) def add_url(self, url: str) -> None: """@url - Fetch and add URL content""" response = requests.get(url) content = html_to_markdown(response.text) self.context.append({ "type": "url", "url": url, "content": content }) def add_problems(self, diagnostics: list) -> None: """@problems - Add IDE diagnostics""" self.context.append({ "type": "diagnostics", "problems": diagnostics }) def format_for_prompt(self) -> str: """Format all context for LLM prompt""" parts = [] for item in self.context: if item["type"] == "file": parts.append(f"## File: {item['path']}\n```\n{item['content']}\n```") elif item["type"] == "url": parts.append(f"## URL: {item['url']}\n{item['content']}") elif item["type"] == "diagnostics": parts.append(f"## Problems:\n{json.dumps(item['problems'], indent=2)}") return "\n\n".join(parts)

模式价值：

统一格式：文件用代码块包裹、URL 转 Markdown、诊断转 JSON，最终拼成结构化的提示词，LLM 更容易定位信息。
限额保护：add_folder默认最多加载 20 个文件，防止文件夹过大致使上下文爆炸。

这与兄弟技能 autonomous-agents 中ContextManager的"令牌预算 + 压缩"思路形成互补：一个解决"怎么装进上下文"，一个解决"装不下时怎么办"（保留系统提示词与最近 N 条消息，中间部分做摘要）。

5.2 检查点 / 断点续跑

长任务随时可能中断（超时、断网、进程被杀）。CheckpointManager将完整 Agent 状态（历史、上下文、工作区状态）序列化到磁盘，实现断点续跑：

class CheckpointManager: """ Save and restore agent state for long-running tasks. """ def __init__(self, storage_dir: str): self.storage_dir = storage_dir os.makedirs(storage_dir, exist_ok=True) def save_checkpoint(self, session_id: str, state: dict) -> str: """Save current agent state""" checkpoint = { "timestamp": datetime.now().isoformat(), "session_id": session_id, "history": state["history"], "context": state["context"], "workspace_state": self._capture_workspace(state["workspace"]), "metadata": state.get("metadata", {}) } path = os.path.join(self.storage_dir, f"{session_id}.json") with open(path, 'w') as f: json.dump(checkpoint, f, indent=2) return path def restore_checkpoint(self, checkpoint_path: str) -> dict: """Restore agent state from checkpoint""" with open(checkpoint_path, 'r') as f: checkpoint = json.load(f) return { "history": checkpoint["history"], "context": checkpoint["context"], "workspace": self._restore_workspace(checkpoint["workspace_state"]), "metadata": checkpoint["metadata"] } def _capture_workspace(self, workspace: str) -> dict: """Capture relevant workspace state""" # Git status, file hashes, etc. return { "git_ref": subprocess.getoutput(f"cd {workspace} && git rev-parse HEAD"), "git_dirty": subprocess.getoutput(f"cd {workspace} && git status --porcelain") }

要点：

状态三件套：history（对话与工具结果）、context（注入的上下文）、workspace_state（Git 提交号 + 工作区脏状态），三者共同定义了"Agent 到哪一步了"。
幂等续跑：恢复后按session_id命名的 JSON 文件即可重建现场；_capture_workspace让恢复时可以比对 Git 状态，判断文件是否被外部改动，从而决定是否继续。

6. MCP（Model Context Protocol）集成

6.1 MCP 服务器模式：动态发现与按需创建工具

MCP 让 Agent 摆脱"内置工具写死"的限制，能够动态发现外部服务器提供的工具，甚至根据一句自然语言描述让 LLM 现场生成一个新的 MCP 服务器并热加载——这是 Cline "Add a tool that..." 模式的直接体现。

from mcp import Server, Tool class MCPAgent: """ Agent that can dynamically discover and use MCP tools. 'Add a tool that...' pattern from Cline. """ def __init__(self, llm): self.llm = llm self.mcp_servers = {} self.available_tools = {} def connect_server(self, name: str, config: dict) -> None: """Connect to an MCP server""" server = Server(config) self.mcp_servers[name] = server # Discover tools tools = server.list_tools() for tool in tools: self.available_tools[tool.name] = { "server": name, "schema": tool.schema } async def create_tool(self, description: str) -> str: """ Create a new MCP server based on user description. 'Add a tool that fetches Jira tickets' """ # Generate MCP server code code = self.llm.generate(f""" Create a Python MCP server with a tool that does: {description} Use the FastMCP framework. Include proper error handling. Return only the Python code. """) # Save and install server_name = self._extract_name(description) path = f"./mcp_servers/{server_name}/server.py" with open(path, 'w') as f: f.write(code) # Hot-reload self.connect_server(server_name, {"path": path}) return f"Created tool: {server_name}"

实现链路由三个环节组成：连接（connect_server）→ 发现（list_tools 同步 schema）→ 按需生成（create_tool 用 LLM 产出 FastMCP 服务器代码并热加载）。每一步都有明确的调用关系，可以对照仓库中其他 MCP 相关技能（如 mcp-builder、mcp-server-security）进一步了解服务器编写与安全加固细节。

需要强调的是：按需生成代码（LLM 写 MCP 服务器）必须叠加第 3 节的权限与沙箱机制——新生成的服务器代码应经过审查或放入隔离环境后再加载，防止注入。

7. 最佳实践检查清单

详细指南在末尾给出了一份可直接作为交付验收标准的检查清单，覆盖设计、安全、体验三个维度：

Agent 设计

Clear task decomposition（清晰的任务分解）
Appropriate tool granularity（合适的工具粒度）
Error handling at each step（每一步都有错误处理）
Progress visibility to user（进度对用户可见）

安全

Permission system implemented（权限系统已实现）
Dangerous operations blocked（危险操作已被拦截）
Sandbox for untrusted code（未信任代码有沙箱）
Audit logging enabled（审计日志已开启）

体验

Approval UI is clear（审批界面清晰）
Progress updates provided（提供进度更新）
Undo/rollback available（支持撤销/回滚）
Explanation of actions（解释每次动作）

这份清单与兄弟技能 autonomous-agents 详细指南中的可靠性原则相互呼应："可靠性优先于自主性，每一步都会放大错误概率；把 AI 输出当作提案而非事实；关键决策必须有人类参与；所有动作必须可审计；失败要可回滚而非静默损坏。"构建自主 Agent 的第一原则永远是：先建护栏，再扩能力。

8. 在仓库技能体系中的定位与使用方式

在 agentic-awesome-skills 仓库中，autonomous-agent-patterns是社区来源（source: community）、critical风险等级的技能，定位于"构建自主编码 Agent"这一任务域。使用建议：

触发时机：当任务涉及构建自主 AI Agent、设计工具/函数调用 API、实现权限与审批系统、为 Agent 做浏览器自动化、设计 human-in-the-loop 工作流时，激活该技能（见 SKILL.md 的 "When to Use This Skill" 段落）。
使用姿势：仓库遵循"根技能定义激活条件、详细指南承载完整程序"的结构。端到端执行前应先通读详细指南；聚焦式工作可只加载相关小节。该技能已在 catalog.json 注册，Agent 可基于autonomous、agent、building coding agents等触发词自动发现。
组合搭配：本文的工程骨架（AgentLoop、工具、权限、沙箱、检查点、MCP）与兄弟技能autonomous-agents的推理模式（ReAct、Plan-Execute、Reflection）配合使用效果最佳；涉及多 Agent 协作时可参考 multi-agent-patterns，涉及工具构建可参考 agent-tool-builder。

总结

本文完整继承了autonomous-agent-patterns技能的六大部分内容，并补充了实现动机与安全细节：从 Agent 循环与多模型路由的架构设计，到工具 Schema、编辑冲突检测的工程实现；从四级权限、动态风险评级与沙箱隔离的安全机制，到浏览器自动化、上下文注入、断点恢复与 MCP 动态工具发现。核心结论可以浓缩为三条：