跳到主要内容
知仓学习社ZHICANG

skill-studio

Interview-driven automation design tool. This skill should be used when the user wants to design a new skill, agent, automation, shortcut, or any ot…

读凭据写文件执行命令联网严重 27 · 高危 28glebis/claude-skills

它会碰到什么

扫了多少85 个文本文件,221 KB
它会碰到什么读凭据写文件执行命令联网
命中总数71 处
命中统计严重 27 · 高 28 · 中 9 · 低 7

这个仓库里自带 1 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。

逐条看命中(30 条严重或高危)
  • 严重 .env.example:7cred-paths
    # SKILL_STUDIO_ENV_FILE=~/.env.skill-studio
  • 严重 .env.example:8cred-paths
    # SKILL_STUDIO_PIPECAT_ENV=~/.env.pipecat
  • 严重 README.md:48cred-paths
    | `SKILL_STUDIO_ENV_FILE` | `~/.env.skill-studio` | Sops-encrypted (or 0600 plaintext) provider keys |
  • 严重 README.md:49cred-paths
    | `SKILL_STUDIO_PIPECAT_ENV` | `~/.env.pipecat` | Voice-mode secrets (Daily / Groq / Deepgram) |
  • 严重 README.md:197cred-paths
    - **`preflight: missing env files`** — voice mode needs `$SKILL_STUDIO_PIPECAT_ENV` to exist. Either create the file or point the env var at your existing one: 
  • 严重 src/skill_studio/paths.py:7cred-paths
    - SKILL_STUDIO_ENV_FILE   — encrypted dotenv (default: $HOME/.env.skill-studio or $SKILL_STUDIO_HOME/.env)
  • 严重 src/skill_studio/paths.py:7cred-paths
    - SKILL_STUDIO_ENV_FILE   — encrypted dotenv (default: $HOME/.env.skill-studio or $SKILL_STUDIO_HOME/.env)
  • 严重 src/skill_studio/paths.py:8cred-paths
    - SKILL_STUDIO_PIPECAT_ENV — voice-mode secrets (default: $HOME/.env.pipecat)
  • 严重 src/skill_studio/paths.py:35cred-paths
    """Encrypted .env (sops) holding LLM + voice provider keys."""
  • 严重 src/skill_studio/paths.py:36cred-paths
    default = Path.home() / ".env.skill-studio"
  • 严重 src/skill_studio/paths.py:41cred-paths
    default = Path.home() / ".env.pipecat"
  • 严重 tests/test_init_wizard.py:46cred-paths
    path = tmp_path / "subdir" / ".env"
  • 严重 tests/test_init_wizard.py:56cred-paths
    env = tmp_path / ".env.skill-studio"
  • 严重 tests/test_init_wizard.py:87cred-paths
    env = tmp_path / ".env.skill-studio"
  • 严重 tests/test_setup.py:7cred-paths
    env_path = tmp_path / ".env.skill-studio"
  • 严重 tests/test_setup.py:8cred-paths
    pipecat_env = tmp_path / ".env.pipecat"
  • 严重 tests/test_setup.py:12cred-paths
    agency_rag_env = tmp_path / ".env.agency-rag"  # does not exist
  • 严重 tests/test_setup.py:16cred-paths
    #   2. Pipecat: "Found .env.pipecat — reuse? [Y/n]" → "y"
  • 严重 tests/test_setup.py:43cred-paths
    """OpenRouter key imported from .env.agency-rag via sops_helper mock."""
  • 严重 tests/test_setup.py:44cred-paths
    env_path = tmp_path / ".env.skill-studio"
  • 严重 tests/test_setup.py:45cred-paths
    pipecat_env = tmp_path / ".env.pipecat"
  • 严重 tests/test_setup.py:46cred-paths
    agency_rag_env = tmp_path / ".env.agency-rag"
  • 严重 tests/test_setup.py:80cred-paths
    env_path = tmp_path / ".env.skill-studio"
  • 严重 tests/test_setup.py:81cred-paths
    pipecat_env = tmp_path / ".env.pipecat"
  • 严重 tests/test_setup.py:82cred-paths
    agency_rag_env = tmp_path / ".env.agency-rag"
  • 严重 tests/test_sops_helper.py:8cred-paths
    plain = tmp_path / ".env.skill-studio"
  • 严重 tests/test_sops_helper.py:23cred-paths
    encrypted = tmp_path / ".env.skill-studio"
  • src/skill_studio/anthropic_client.py:14cred-envread
    self.client = client or Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])
  • src/skill_studio/cli.py:175identity-config-write
    print(f"{s.meta.id[:8]}  preset={s.meta.preset}  hook={s.hook[:60]}")
  • src/skill_studio/ingest/transcript.py:129cred-envread
    return os.environ.get("CLAUDE_CODE_SESSION_ID")

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Skill Studio

Purpose

Conduct a structured JTBD interview that captures what to build, for whom, and why — then emit a one-page design.md + design.svg spec. Sits between "should I automate this?" (automation-advisor) and "how do I package this as a skill?" (skill-creator).

Architecture

This skill wraps an external CLI tool (skill-studio) installed via pip. The CLI handles session state, coverage tracking, and export. The skill orchestrates the CLI — it does not bundle scripts directly.

When to use

Trigger on any of: "help me design...", "build a skill for...", "design an automation for...", "I want a bot/agent/workflow that...", "scope a new shortcut". Also trigger when the user describes a recurring pain and asks how to automate it.

Also trigger for session analysis: "analyze this session", "what skills could I build from this", "propose skills from session", "what workflows did I use", "what did I do in this session", "extract patterns from my work", "turn this session into a skill", "what could be automated from this". If the user references a session ID or asks about subagent activity, this skill handles it.

Prerequisites

  • skill-studio CLI on PATH (pip install -e . inside the skill directory, or skill-studio init for guided setup)
  • Python 3.11+
  • Text mode needs no API key — the interview runs natively inside Claude Code
  • Voice mode (--voice) needs DAILY_API_KEY, GROQ_API_KEY, DEEPGRAM_API_KEY, and an LLM provider key (OPENROUTER_API_KEY by default). If any key is missing, suggest text mode instead.

To verify the CLI is available, run skill-studio --help. If the command is not found, install it from the skill's base directory: pip install -e <skill-studio-base-dir>.

Interview protocol (text mode)

Follow these steps in order.

Step 0 — (Optional) Seed from a prior session

If the user provides a prior session (Claude Code transcript, another skill-studio session, or arbitrary transcript path), seed the interview instead of starting blank:

# Analyze the current running session
skill-studio propose-from-session --current

# Analyze a specific session by ID (prefix match works)
skill-studio propose-from-session <session_id>

# Analyze a session from a specific project
skill-studio propose-from-session <session_id> --project <project-dir-name>

# Analyze an arbitrary transcript file
skill-studio propose-from-session --path <file>

# Inspect the raw extracted bundle without an LLM call
skill-studio propose-from-session --current --bundle-only

This runs in two stages:

  1. Deterministic ingest (no LLM) — extracts models tried, cost events, prompt changes, pain snippets, subagent calls (Agent tool with descriptions, types, prompt snippets), skill invocations, tool sequences (ordered list of all tool calls), tool frequency, and workflow patterns (repeated multi-tool sequences). A 50k-token transcript compresses to a compact structured JSON bundle.
  2. Single LLM call — over that compact bundle only, proposes a partial DesignJSON patch with a rationale map citing which signals justified each field, plus skill proposals — potential new skills derived from observed workflow patterns and agent orchestration.

The bundle includes these structured signals:

  • agents — subagent calls with description, subagent_type, and prompt_snippet
  • skills — skill invocations observed during the session
  • tool_sequence — ordered list of all tool calls with descriptions
  • tool_frequency — how often each tool was used
  • workflow_patterns — repeated tool sequences (e.g. "Read → Edit → Bash" appearing 3× suggests a test-fix cycle)

The proposal is NOT applied automatically. Present it to the user (with the rationale and any skill proposals) and ask for approval. Offer: approve as-is, edit inline, discard and start fresh, approve partial (keep some fields, re-interview others).

If the proposal includes skill_proposals, present them separately and ask if the user wants to proceed to /skill-creator with any of them.

propose-from-session does not create a session. After approval, run new-session (Step 1) to create one, then pipe the approved patch to apply-patch, and continue the interview loop from the next uncovered target.

Browsing Claude Code sessions

To help the user pick a session to analyze:

# List recent sessions (most recent first, all projects)
skill-studio list-sessions

# Filter to a specific project
skill-studio list-sessions --project <project-dir-name>

# Show more results
skill-studio list-sessions --limit 50

Output shows session ID prefix, age, size, and title.

Step 1 — Start the session

Presets: ai-agent (default), life-automation, knowledge-work, custom.

Depth: sprint (0.60, ~5–7 questions), standard (0.80, ~15–20 questions, default), deep (0.92, ~25–35 questions).

Styles (shape how questions are phrased):

  • scenario-first (default) — "Walk me through a specific time when..."
  • socratic — "Why does that matter? What would happen if...?"
  • metaphor-first — "If this automation were a [thing], what would it be?"
  • form — One direct question per field, no preamble.

Run:

skill-studio new-session --preset <preset> --depth <depth> --style <style>

Output:

session_id: <uuid>
opening: <question text>

Store the session_id. Present the opening question to the user as a direct text message.

Step 2 — Interview loop

For every user answer:

a. Extract a JSON patch. Emit a JSON object containing only the DesignJSON fields the answer addresses. Use only fields from the schema below — never hallucinate fields or values. If nothing schema-relevant was said, emit {}.

Example patch:

{"jtbd.situation": "When I finish a coaching call and need to write up notes", "problem.what_hurts": "Manual note-taking takes 20 minutes and I lose details"}

Example with list fields:

{"needs.functional": ["transcribe audio", "extract action items"], "guardrails": ["never send notes without review"]}

Example with object-list field (scenarios):

{"scenarios": [{"title": "Post-coaching rush", "vignette": "Call ends at 14:00, next meeting at 14:15 — I scribble three bullet points and lose the rest by evening."}]}

DesignJSON fields:

| Field | Type | Notes |

|-------|------|-------|

| hook | str | One-sentence pitch of the automation |

| problem.what_hurts | str | Specific pain |

| problem.cost_today | str | What the pain costs right now |

| needs.functional | list[str] | What it must do |

| needs.emotional | list[str] | How the user wants to feel |

| needs.social | list[str] | Relational / status needs |

| jtbd.situation | str | When this happens |

| jtbd.motivation | str | What the user wants |

| jtbd.outcome | str | So they can... |

| before_after.before_external | str | Visible state before |

| before_after.before_internal | str | Felt state before |

| before_after.after_external | str | Visible state after |

| before_after.after_internal | str | Felt state after |

| scenarios | list[{title, vignette}] | Concrete day-in-the-life stories |

| trigger.type | manual / scheduled / event | |

| trigger.detail | str | e.g. "7:45am weekdays" |

| inputs | list[str] | Data / services consumed |

| capabilities | list[str] | What it does |

| outputs | list[str] | What it produces |

| guardrails | list[str] | Safety rails; negative-space rules |

| cta | str | Next action at end of design |

| concept_imagery.metaphor | str | Visual / verbal handle |

b. Apply the patch.

echo '<patch_json>' | skill-studio apply-patch <session_id>

Output:

coverage: 0.42
next_target: jtbd.situation

c. Check stop conditions. End the loop if either:

  • coverage >= threshold (sprint=0.60, standard=0.80, deep=0.92)
  • User says "done", "wrap up", or "stop"

d. Ask the next question. Target the next_target field, in the active style. Never re-ask a field already past 0.5 coverage. Present the question as direct text to the user.

Step 3 — Export

skill-studio done <session_id>

Prints the paths to design.md and design.svg. Present both paths to the user.

Voice mode

For voice interviews, skip the manual loop and delegate to the built-in pipeline:

skill-studio new --voice --preset <preset> --depth <depth>

This spins up a Daily room (auto-opens in the browser), runs Groq Whisper STT -> interview loop -> Deepgram TTS, and auto-exports on session end.

If voice mode fails due to missing API keys, fall back to text mode and inform the user. To configure keys, run skill-studio init.

Other commands

  • skill-studio list — list all skill-studio interview sessions
  • skill-studio list-sessions — list Claude Code sessions (most recent first)
  • skill-studio list-sessions --project <name> — filter by project
  • skill-studio export <id> md-svg — regenerate design.md + design.svg
  • skill-studio coverage <id> — per-field confidence JSON
  • skill-studio next-target <id> — ask-this-next hint
  • skill-studio init — full first-run wizard (prereq checks + keys + paths)
  • skill-studio setup — narrower key-rotation flow (sops-only)

Sessions

Each interview writes to $SKILL_STUDIO_HOME/sessions/<uuid>/ (default: ~/.skill-studio/sessions/<uuid>/):

  • design.json — canonical schema (single source of truth)
  • transcript.md — full Q&A log
  • design.md, design.svg — exported artifacts

Troubleshooting

  • skill-studio: command not found — Run pip install -e <skill-studio-base-dir> and retry.
  • apply-patch returns an error — Verify the JSON patch is valid (keys must match schema fields above). Run skill-studio coverage <session_id> to inspect current state.
  • Session not found — Always run new-session before the first apply-patch. There is no implicit session creation. Run skill-studio list to check existing sessions.
  • Voice mode key errors — Run skill-studio init to configure missing keys, or fall back to text mode.

Notes

  • The interview loop runs entirely inside Claude Code for text mode. No Anthropic API key is required.
  • Voice mode LLM provider is swappable via LLM_PROVIDER=anthropic (default is openrouter).

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。