跳到主要内容
知仓学习社ZHICANG

workthreads

SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, G…

执行命令读文件写文件读环境变量(配置)严重 1 · 高危 3specstoryai/getspecstory

它会碰到什么

扫了多少13 个文本文件,78 KB
它会碰到什么执行命令读文件写文件读环境变量(配置)
命中总数12 处
命中统计严重 1 · 高 3 · 中 8 · 低 0

这个仓库里自带 6 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。

关于「读环境变量(配置)」:这个技能会读 process.env 之类的环境变量,但读到的都是端口、目录、超时这类配置项,没有读取密钥类变量。扫描规则原本把「读环境变量」一律算作「读凭据」,本站按变量名做了细化区分,命中明细仍如实列在下面。

逐条看命中(4 条严重或高危)
  • 严重 docs/2026-06-24-WORKTHREADS-AS-BUILT.md:66cred-paths
    keys - any in more than 4 sessions, plus config files (`.env`, `package.json`, tool
  • scripts/lib/indexer.mjs:12exec-spawn
    import { execFileSync } from 'node:child_process'
  • scripts/lib/indexer.mjs:77cred-envread
    const author = authors.get(basename(path)) || sniffAuthor(text) || process.env.USER || 'unknown'
  • scripts/lib/patterns.mjs:104exec-shell-true
    export const LEGACY_TYPE = { Bash: 'shell', shell: 'shell', shell_command: 'shell', exec_command: 'shell', Read: 'read', WebFetch: 'read', Write: 'write', Edit:

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Workthreads

A lead needs a weekly answer across the team's repos: what work happened this week, what got

finished, and what is still open and needs a next step. Workthreads produces that rollup

from SpecStory histories - the .specstory/history transcripts your coding agents already write.

It reports lines of work and their lifecycle (new / open / recently closed).

A deterministic engine (scripts/workthreads.mjs threads) does the retrieval, clustering, and

classification; you do the synthesis - you turn its evidence into the lead's weekly report.

Do not try to read raw transcripts yourself; they can be hundreds of thousands of lines. Run the

engine and write the rollup from its output.

This skill is harness-portable (agentskills.io format). Where it names a specific tool

(e.g. AskUserQuestion), treat that as "use your harness's equivalent; fall back to plain chat."

How the engine splits the work

  • The engine groups the window's beats by project and clusters them into threads (a line

of work that can span several sessions). It assigns each thread one lifecycle status relative

to today:

  • new - first activity within the last 7 days.
  • open - unresolved, still active (the open loops).
  • closed - latest outcome was success and the thread has gone quiet; flagged reverted

when a beat ran a rollback command (git revert / git reset --hard / git checkout -- ...).

  • Output is deterministic (stable sort, no wall-clock timestamps in the body), so two runs on the

same corpus are byte-identical.

Default flow: the weekly rollup

  1. Index the corpus into workthreads' own DB. Point at the team's repos and build/update it:
   node "${CLAUDE_SKILL_DIR}/scripts/workthreads.mjs" index --projects <parent-of-repos> --db <db>
   # or a single tree:  --scan <root>     or a single history dir:  --dir <dir>
  1. Run threads cross-project for the last 7 days and capture the evidence:
   node "${CLAUDE_SKILL_DIR}/scripts/workthreads.mjs" threads --db <db> --days 7            # human digest
   node "${CLAUDE_SKILL_DIR}/scripts/workthreads.mjs" threads --db <db> --days 7 --json     # machine-readable

The digest prints, per project, three sections in order - New, Open, **Recently

closed** - each thread with its evidence refs (path:line), last-activity date, status, and a

reverted marker. --json emits an array of threads (project, status, reverted, the files

touched, last-activity date).

  1. Write the rollup from that evidence, in the lead's shape:
  • (a) a high-level result: session count and active projects in the window;
  • (b) per-project highlights of completed work (the closed threads);
  • (c) open loops - the open threads, unresolved or needing verification, with a suggested

next step each;

  • (d) notable rollbacks / abandoned efforts (the reverted threads);
  • (e) cite evidence refs (path:line) so each claim is checkable.

Add a caveat that the week may still be in progress, so open and new threads are

snapshots, not final outcomes.

  1. Save it to a dated file so the rollup is durable and diffable week over week:
   .specstory/workthreads/<YYYY>-W<week>.md

(ISO week number, e.g. .specstory/workthreads/2026-W25.md). Also offer threads --out <file>

to drop the raw digest beside your written summary.

Guided start

If the user just invokes the skill with no specifics, ask three short questions (use

AskUserQuestion or plain chat), then run the default flow with the answers:

  • Scope - which repos / parent directory holds the team's .specstory/history corpus?
  • Window - how many days back? (default 7 for the weekly rollup; --days N to widen.)
  • Goal - the whole rollup, just the open loops, just recently closed, or a quick

status line? Tailor which sections you emphasize to the answer.

Conventions

Node ESM only, zero dependencies, Node >= 22.5. No em dashes anywhere (use " - "). The engine path

never calls an LLM or the network; all judgment (the written narrative, suggested next steps,

emphasis) is yours.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 1,333
本站分层T2
该仓技能数2
原文件路径workthreads/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 2 个技能