跳到主要内容
知仓学习社ZHICANG

ck

Persistent per-project memory for Claude Code. Auto-loads project context on session start, tracks sessions with git activity, and writes to native …

改身份文件执行命令写文件读文件读环境变量(配置)严重 0 · 高危 20affaan-m/ECC

它会碰到什么

扫了多少10 个文本文件,49 KB
它会碰到什么改身份文件执行命令写文件读文件读环境变量(配置)
命中总数51 处
命中统计严重 0 · 高 20 · 中 31 · 低 0

关于「读环境变量(配置)」:这个技能会读 process.env 之类的环境变量,但读到的都是端口、目录、超时这类配置项,没有读取密钥类变量。扫描规则原本把「读环境变量」一律算作「读凭据」,本站按变量名做了细化区分,命中明细仍如实列在下面。

逐条看命中(20 条严重或高危)
  • commands/forget.mjs:19cred-envread
    const cwd = process.env.PWD || process.cwd();
  • commands/info.mjs:14cred-envread
    const cwd = process.env.PWD || process.cwd();
  • commands/init.mjs:15cred-envread
    const cwd = process.env.PWD || process.cwd();
  • commands/init.mjs:100identity-write
    // ── CLAUDE.md ─────────────────────────────────────────────────────────────────
  • commands/init.mjs:101identity-write
    const claudeMd = readFile('CLAUDE.md');
  • commands/list.mjs:13cred-envread
    const cwd = process.env.PWD || process.cwd();
  • commands/resume.mjs:15cred-envread
    const cwd = process.env.PWD || process.cwd();
  • commands/save.mjs:28cred-envread
    const cwd    = process.env.PWD || process.cwd();
  • commands/shared.mjs:11exec-spawn
    import { spawnSync } from 'child_process';
  • commands/shared.mjs:11exec-spawn
    import { spawnSync } from 'child_process';
  • commands/shared.mjs:147exec-spawn
    const result = spawnSync('git', ['-C', cwd, ...args], {
  • hooks/session-start.mjs:13identity-write
    * - Goal mismatch detection vs CLAUDE.md
  • hooks/session-start.mjs:20exec-spawn
    import { spawnSync } from 'child_process';
  • hooks/session-start.mjs:20exec-spawn
    import { spawnSync } from 'child_process';
  • hooks/session-start.mjs:50exec-spawn
    const result = spawnSync(
  • hooks/session-start.mjs:63identity-write
    const p = resolve(projectPath, 'CLAUDE.md');
  • hooks/session-start.mjs:84cred-envread
    const cwd = process.env.PWD || process.cwd();
  • hooks/session-start.mjs:145identity-write
    summaryLines.push(`WARNING Goal mismatch — ck: "${context.goal.slice(0, 40)}" · CLAUDE.md: "${claudeMdGoal.slice(0, 40)}"`);
  • SKILL.md:130identity-config-write
    "hooks": {
  • SKILL.md:132identity-config-write
    { "hooks": [{ "type": "command", "command": "node \"~/.claude/skills/ck/hooks/session-start.mjs\"" }] }

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

ck — Context Keeper

You are the Context Keeper assistant. When the user invokes any /ck:* command,

run the corresponding Node.js script and present its stdout to the user verbatim.

Scripts live at: ~/.claude/skills/ck/commands/ (expand ~ with $HOME).


Data Layout

~/.claude/ck/
├── projects.json              ← path → {name, contextDir, lastUpdated}
└── contexts/<name>/
    ├── context.json           ← SOURCE OF TRUTH (structured JSON, v2)
    └── CONTEXT.md             ← generated view — do not hand-edit

Commands

/ck:init — Register a Project

node "$HOME/.claude/skills/ck/commands/init.mjs"

The script outputs JSON with auto-detected info. Present it as a confirmation draft:

Here's what I found — confirm or edit anything:
Project:     <name>
Description: <description>
Stack:       <stack>
Goal:        <goal>
Do-nots:     <constraints or "None">
Repo:        <repo or "none">

Wait for user approval. Apply any edits. Then pipe confirmed JSON to save.mjs --init:

echo '<confirmed-json>' | node "$HOME/.claude/skills/ck/commands/save.mjs" --init

Confirmed JSON schema: {"name":"...","path":"...","description":"...","stack":["..."],"goal":"...","constraints":["..."],"repo":"..." }


/ck:save — Save Session State

This is the only command requiring LLM analysis. Analyze the current conversation:

  • summary: one sentence, max 10 words, what was accomplished
  • leftOff: what was actively being worked on (specific file/feature/bug)
  • nextSteps: ordered array of concrete next steps
  • decisions: array of {what, why} for decisions made this session
  • blockers: array of current blockers (empty array if none)
  • goal: updated goal string only if it changed this session, else omit

Show a draft summary to the user: "Session: '<summary>' — save this? (yes / edit)"

Wait for confirmation. Then pipe to save.mjs:

echo '<json>' | node "$HOME/.claude/skills/ck/commands/save.mjs"

JSON schema (exact): {"summary":"...","leftOff":"...","nextSteps":["..."],"decisions":[{"what":"...","why":"..."}],"blockers":["..."]}

Display the script's stdout confirmation verbatim.


/ck:resume [name|number] — Full Briefing

node "$HOME/.claude/skills/ck/commands/resume.mjs" [arg]

Display output verbatim. Then ask: "Continue from here? Or has anything changed?"

If user reports changes → run /ck:save immediately.


/ck:info [name|number] — Quick Snapshot

node "$HOME/.claude/skills/ck/commands/info.mjs" [arg]

Display output verbatim. No follow-up question.


/ck:list — Portfolio View

node "$HOME/.claude/skills/ck/commands/list.mjs"

Display output verbatim. If user replies with a number or name → run /ck:resume.


/ck:forget [name|number] — Remove a Project

First resolve the project name (run /ck:list if needed).

Ask: "This will permanently delete context for '<name>'. Are you sure? (yes/no)"

If yes:

node "$HOME/.claude/skills/ck/commands/forget.mjs" [name]

Display confirmation verbatim.


/ck:migrate — Convert v1 Data to v2

node "$HOME/.claude/skills/ck/commands/migrate.mjs"

For a dry run first:

node "$HOME/.claude/skills/ck/commands/migrate.mjs" --dry-run

Display output verbatim. Migrates all v1 CONTEXT.md + meta.json files to v2 context.json.

Originals are backed up as meta.json.v1-backup — nothing is deleted.


SessionStart Hook

The hook at ~/.claude/skills/ck/hooks/session-start.mjs must be registered in

~/.claude/settings.json to auto-load project context on session start:

{
  "hooks": {
    "SessionStart": [
      { "hooks": [{ "type": "command", "command": "node \"~/.claude/skills/ck/hooks/session-start.mjs\"" }] }
    ]
  }
}

The hook injects ~100 tokens per session (compact 5-line summary). It also detects

unsaved sessions, git activity since last save, and goal mismatches vs CLAUDE.md.


Rules

  • Always expand ~ as $HOME in Bash calls.
  • Commands are case-insensitive: /CK:SAVE, /ck:save, /Ck:Save all work.
  • If a script exits with code 1, display its stdout as an error message.
  • Never edit context.json or CONTEXT.md directly — always use the scripts.
  • If projects.json is malformed, tell the user and offer to reset it to {}.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

同名技能的其他版本

有 3 个不同仓库或目录里都有叫 ck 的技能。它们内容并不相同,别混用:

  • affaan-m/ECC — Claude Codeの永続的なプロジェクト単位のメモリ。セッション開始時にプロジェクトコンテキストを自動読み込み、gitアクティビティでセッションを追跡し、ネイティブメモリに書き
  • affaan-m/ECC — Claude Code 的每个项目持久化记忆。在会话启动时自动加载项目上下文,通过 git 活动追踪会话,并写入原生记忆。命令运行确定性的 Node.js 脚本——行为在不同模型版