skill-idea-miner

Savant verdict: Unsafe

Savant's security policy blocks importing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

10 patterns found

• Data Exfiltration: os.environ.items()high · scripts/mine_session_logs.py:482 · Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
• Data Exfiltration: os.environ.items()high · scripts/score_ideas.py:194 · Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
• MCP Least Privilege: Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.medium · SKILL.md:1 · Without declared permissions the skill's intent is opaque and cannot be validated.
• Dangerous Code Execution: subprocess.run( # nosec B607 – claude CLI is an expected dependency [ "claude", "-p", "--output-format", "json",medium · scripts/mine_session_logs.py:485 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: subprocess.run( # nosec B607 – claude CLI is an expected dependency [ "claude", "-p", "--output-format", "json",medium · scripts/score_ideas.py:197 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Rogue Agent: Create mock dirs matching allowlist encoding, verify matches.""" # Simulate ~/.claudemedium · scripts/tests/test_mine_session_logs.py:32 · Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
• Agent Snooping: skills/pead-screener/SKILL.mdmedium · scripts/tests/test_mine_session_logs.py:226 · Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
• Agent Snooping: skills/pead-screener/SKILL.mdmedium · scripts/tests/test_mine_session_logs.py:382 · Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
• Supply Chain: PyYAML>=6.0low · requirements.txt:3 · Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
• Supply Chain: PyYAMLlow · requirements.txt:3 · Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Structure

• 1 referenced file isn't in the packagescripts/run_skill_generation_pipeline.py. They may be binary, too large to catalog, or missing upstream.
• Ships 6 executable scriptsscripts/__init__.py, scripts/mine_session_logs.py, scripts/score_ideas.py, scripts/tests/conftest.py, scripts/tests/test_mine_session_logs.py, …. Review what they do before enabling the skill for agents with tool access.
• No license declaredConfirm you may reuse this skill before importing it into your repository.
• The source hub's security checks flagged this skillSnyk: warn (Risk: MEDIUM · 1 issue); Runlayer: fail (4/7 files flagged)

SKILL.md

---
name: skill-idea-miner
description: Mine Claude Code session logs for skill idea candidates. Use when running the weekly skill generation pipeline to extract, score, and backlog new skill ideas from recent coding sessions.
---

# Skill Idea Miner

Automatically extract skill idea candidates from Claude Code session logs,
score them for novelty, feasibility, and trading value, and maintain a
prioritized backlog for downstream skill generation.

## When to Use

- Weekly automated pipeline run (Saturday 06:00 via launchd)
- Manual backlog refresh: `python3 scripts/run_skill_generation_pipeline.py --mode weekly`
- Dry-run to preview candidates without LLM scoring

## Prerequisites

- **Python 3.10+** with `pyyaml` package
- **Claude CLI** installed and authenticated (`claude --version` to verify)
- **Session logs** in `~/.claude/projects/<project>/` (created automatically by Claude Code)
- No API keys required (uses Claude CLI for LLM calls)

## Workflow

### Quick Start

```bash
# Dry-run: preview mined candidates without LLM scoring
python3 scripts/mine_session_logs.py --dry-run --output-dir reports/

# Full mining with scoring (requires Claude CLI)
python3 scripts/mine_session_logs.py --output-dir reports/

# Score existing candidates
python3 scripts/score_ideas.py \
  --candidates reports/raw_candidates.yaml \
  --output-dir logs/
```

### Stage 1: Session Log Mining

1. Enumerate session logs from allowlist projects in `~/.claude/projects/`
2. Filter to past 7 days by file mtime, confirm with `timestamp` field
3. Extract user messages (`type: "user"`, `userType: "external"`)
4. Extract tool usage patterns from assistant messages
5. Run deterministic signal detection:
   - Skill usage frequency (`skills/*/` path references)
   - Error patterns (non-zero exit codes, `is_error` flags, exception keywords)
   - Repetitive tool sequences (3+ tools repeated 3+ times)
   - Automation request keywords (English and Japanese)
   - Unresolved requests (5+ minute gap after user message)
6. Invoke Claude CLI headless for idea abstraction
7. Output `raw_candidates.yaml`

### Stage 2: Scoring and Deduplication

1. Load existing skills from `skills/*/SKILL.md` frontmatter
2. Deduplicate via Jaccard similarity (threshold > 0.5) against:
   - Existing skill names and descriptions
   - Existing backlog ideas
3. Score non-duplicate candidates with Claude CLI:
   - Novelty (0-100): differentiation from existing skills
   - Feasibility (0-100): technical implementability
   - Trading Value (0-100): practical value for investors/traders
   - Composite = 0.3 * Novelty + 0.3 * Feasibility + 0.4 * Trading Value
4. Merge scored candidates into `logs/.skill_generation_backlog.yaml`

## Output Format

### raw_candidates.yaml

```yaml
generated_at_utc: "2026-03-08T06:00:00Z"
period: {from: "2026-03-01", to: "2026-03-07"}
projects_scanned: ["claude-trading-skills"]
sessions_scanned: 12
candidates:
  - id: "raw_2026w10_001"
    title: "Earnings Whispers Image Parser"
    source_project: "claude-trading-skills"
    evidence:
      user_requests: ["Extract earnings dates from screenshot"]
      pain_points: ["Manual image reading"]
      frequency: 3
    raw_description: "Parse Earnings Whispers screenshots to extract dates."
    category: "data-extraction"
```

### Backlog (logs/.skill_generation_backlog.yaml)

```yaml
updated_at_utc: "2026-03-08T06:15:00Z"
ideas:
  - id: "idea_2026w10_001"
    title: "Earnings Whispers Image Parser"
    description: "Skill that parses Earnings Whispers screenshots..."
    category: "data-extraction"
    scores: {novelty: 75, feasibility: 60, trading_value: 80, composite: 73}
    status: "pending"
```

## Resources

- `references/idea_extraction_rubric.md` — Signal detection criteria and scoring rubric
- `scripts/mine_session_logs.py` — Session log parser
- `scripts/score_ideas.py` — Scorer and deduplicator