Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Stuck

v1.0.0

Generate a structured help-request document when stuck with AI coding. Scans specified conversation sessions, extracts errors and failed attempts, outputs a...

0· 10·0 current·0 all-time
by不足为道@buzuweidao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to scan conversation sessions and produce a HELP_REQUEST.md; the included python script clearly parses local conversation files from multiple AI tools (~/.claude, ~/.codex, ~/.openclaw, ~/.gemini) and extracts errors, which is coherent with the stated purpose. However, SKILL.md calls the script via a hard-coded path (~/.claude/skills/stuck/scripts/parse_conversations.py) while the bundle only contains scripts/parse_conversations.py and there is no install spec — that path/installation expectation is inconsistent and may prevent correct operation or cause the agent to attempt to place files under unexpected locations.
Instruction Scope
Runtime instructions require running the script to list and then summarize user-selected conversation files. The script legitimately reads many conversation-history locations in the user's home directory to build the list and to summarize selected files. The SKILL.md promises strict user confirmation at each step and limiting to only user-specified conversations; those constraints reduce risk. Still, the script will read potentially sensitive local history files (chat transcripts, tool outputs), so users should be aware it accesses multiple home-directory paths and may parse large files.
Install Mechanism
No install spec is present (instruction-only skill with bundled script). There is no network download or archive extraction. That is lower-risk than remote installers, but the mismatch between where SKILL.md expects the script to live and the bundle's file layout is a practical issue to resolve before use.
Credentials
The skill requests only python3 and no environment variables or credentials, which is proportionate. SKILL.md claims it will auto-desensitize API-key‑like strings, convert absolute usernames to relative paths, and redact emails before saving — but the included script content is truncated in the supplied package listing, so it's not possible to confirm that the redaction is actually implemented. Verify the script performs the claimed redaction before use.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It does read user files when invoked, but does not request elevated system privileges or modify other skills' configurations. This is normal for a utility that reads local conversation history.
What to consider before installing
This skill's purpose is reasonable for creating help requests from AI chats, but review these before installing or running it: - Confirm where the script will be placed and invoked. SKILL.md expects ~/.claude/skills/stuck/scripts/parse_conversations.py, but the bundle contains scripts/parse_conversations.py and there is no install step — update placement or the invocation path before running. - Inspect the full parse_conversations.py (the supplied file listing was truncated). Make sure there are no network calls, remote endpoints, or write-to-remote behaviors in the remainder of the script. The visible portion only reads local files and extracts text, but the rest must be checked to verify no exfiltration. - Verify the claimed automatic redaction is actually implemented and tested (API keys, emails, absolute usernames). If you cannot confirm, treat generated HELP_REQUEST.md as potentially containing secrets and sanitize manually. - Be aware the script reads conversation histories under ~/.claude, ~/.codex, ~/.openclaw, and ~/.gemini — these can include sensitive data. The SKILL.md requires explicit user selection of which sessions to process; do not skip that step. - If you want to be cautious, run the script in a constrained environment or on a copy of conversation files first, and open the generated HELP_REQUEST.md to verify redaction before sharing. If you can confirm the script content (no network I/O, proper redaction) and correct the path/install mismatch, the skill appears coherent with its stated purpose. Otherwise treat it as potentially unsafe and do not run it on sensitive data.

Like a lobster shell, security has layers — review code before you run it.

latestvk979qxxxw58bvq8cpe9aj5gzk1842pqt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🆘 Clawdis
Binspython3

SKILL.md

stuck

从 AI 对话记录中提取错误信息,生成一份结构化的求助文档。

触发条件

用户说 stuck、卡住了、AI 修不好、生成求助文档、help request。

强制流程

这是一个引导式交互流程。每一步必须严格按顺序执行,不能跳过,不能合并,不能自动推进。每一步结束后必须停下来等用户响应,收到用户明确的回复后才能进入下一步。

步骤 1:问问题

问用户:

你卡在什么问题上?一句话描述。

然后停下来。等用户回答。不做任何其他事情。

步骤 2:确定对话范围

收到步骤 1 的回答后,运行以下命令列出最近的对话:

python3 ~/.claude/skills/stuck/scripts/parse_conversations.py list-all <当前工作目录的绝对路径>

将结果加上编号展示给用户(如 [1] claude_code 2026-03-29 ..., [2] codex_cli 2026-03-28 ...),然后问:

这个问题你在哪几个对话里处理的?请告诉我编号。

然后停下来。等用户选择。不做任何其他事情。

步骤 3:提取错误

收到步骤 2 的回答后,对用户指定的每个对话文件,运行以下命令提取信息:

python3 ~/.claude/skills/stuck/scripts/parse_conversations.py summary <文件绝对路径>

注意:如果文件大于 10MB,提醒用户该文件较大,提取可能需要一些时间,并只提取最近 50 轮交互的内容。

从提取结果中获取:

  • 报错信息(原文)
  • AI 尝试了哪些方案
  • 交互了多少轮
  • 哪些方案失败了,失败的表现是什么

从提取结果中自动判断失败模式:

  • 同一个错反复出现 → 死循环
  • 修好 A 坏了 B → 退化
  • 每次方向完全不同 → 发散
  • AI 说修好了但错误还在 → 沉默失败

提取完成后,把提取结果的摘要展示给用户,然后问:

这些信息准确吗?有没有遗漏的关键错误或需要补充的上下文?

然后停下来。等用户确认。不做任何其他事情。

步骤 4:生成文档

收到步骤 3 的确认后,生成 HELP_REQUEST.md 到项目目录,包含:

# 求助文档

## 问题
{用户在步骤1描述的一句话}

## 环境
- AI 工具: {从对话记录自动检测}
- 技术栈: {从项目文件自动检测}
- 持续时间: {从对话时间戳计算}
- 交互轮数: {从对话记录统计}

## 错误信息
{从对话记录提取的关键报错,原文}

## AI 尝试过的方案
{按时间顺序列出,标注每个方案的结果}

## 失败模式
{工具自动判断的结果}

## 已排除的方向
{确认无效的方案,避免帮助者重复建议}

## 相关代码
{问题所在的文件和关键函数}

保存前自动脱敏:

  • API key 格式的字符串 → [REDACTED]
  • 包含用户名的绝对路径 → 相对路径
  • 邮箱地址 → [REDACTED]

保存后展示给用户,然后问:

文档已生成。你看一下有没有需要修改的地方?

然后停下来。等用户确认。

用户确认后,流程结束。

绝对规则

  • 每一步之间必须停下来等用户回复。绝对不能跳步、合并步骤、或在用户没回复时自动推进。
  • 只扫描用户指定的对话,不扫描全部
  • 失败模式由工具自动判断,不问用户选择
  • 错误信息保留原文,不总结不改写
  • 文档面向的读者是对项目零了解的人或 AI

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…