📦

ci-transit

Name: ci-transit
Author: israelvicars

Inhaltsrevision r1 Mittleres Risiko 📁 Dateisystemzugriff⚡ Enthält Skripte⚙️ Externe Befehle🔑 Umgebungsvariablen🌐 Netzwerkzugriff

Visualize GitHub Actions Runs as Transit Maps

Long CI runs make failed steps and timing relationships difficult to review. This skill turns run metadata into interactive transit maps and optional visual exports.

Unterstützt: Claude Codex Code(CC)

⚠️ 50 Schlecht

Maintain this Skill? Claim it ⚠️ 50 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "ci-transit" from https://skillstore.io/skills/israelvicars-ci-transit.md and its manifest at https://skillstore.io/api/skills/israelvicars-ci-transit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/israelvicars-ci-transit.md Signiertes manifest GET /api/skills/israelvicars-ci-transit/manifest Signiertes lockfile GET /api/skills/israelvicars-ci-transit/lockfile

Testen

„ci-transit“ wird verwendet. Map a saved run containing a failed unit-test step.

Erwartetes Ergebnis:

Interactive HTML map created locally, with each job represented as a line.
The failed unit-test step is marked with a service alert and selectable timing details.
No artifact was uploaded.

„ci-transit“ wird verwendet. Render a large run with a long idle period using default settings.

Erwartetes Ergebnis:

The map indicates that only failed or cancelled step stations are shown.
Long idle periods are shortened, and the page labels the compressed timing.
Full step detail and wall-clock timing remain available through explicit build options.

„ci-transit“ wird verwendet. Create and verify an animation from a synthetic CI sample.

Erwartetes Ergebnis:

Local GIF, MP4, and contact-sheet files are generated when rendering dependencies are available.
Verification reports frame reproducibility, departure timing, and blank or frozen segment checks.
Failed checks are reported without claiming the render passed.

Sicherheitsaudit

Mittleres Risiko

v1 • 22.10.2026 Versionsbericht öffnen

Most matches are syntax or legitimate tooling; confirmed risks include dependency lifecycle execution, contract-panel HTML injection, insecure credential transport, and predictable temporary files. Strict sharing can retain sensitive identifiers, and setup networking exceeds documented boundaries. The static cap leaves 245 matches unadjudicated, so manual review remains necessary. Static review was capped at 400/645 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

4,753

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Mittel

src/ci-transit/adapters/normalize-gh.mjs:35-40 core/scrub.mjs:94-107 core/build.mjs:117-121

Strict Sharing Retains Sensitive Fallback Identifiers

Jobs without databaseId use job names in span identifiers. Strict scrubbing changes display names but preserves identifiers, leaving embedded emails or secrets in shared HTML.

A synthetic job without databaseId retained user@example.com in span identifiers after strict scrubbing. Its displayed name was correctly scrubbed, confirming the separate identifier leak.

Mittel

SKILL.md:12 core/setup.mjs:111-115 core/setup.mjs:171-178

Setup Networking Exceeds the Documented Boundary

SKILL.md states that optional GitHub fetching is the only network use. Rendering setup can also download npm dependencies and Chromium, without an interactive confirmation.

The documentation makes an exclusive network-use claim, but setup explicitly invokes dependency and browser downloads. No evidence found of telemetry or deliberate trace exfiltration.

Elemente der Fähigkeitsprüfung (6)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

core/setup.mjs:48

Synchronous spawn

const r = spawnSync(cmd, args, { cwd: ROOT, stdio: ['ignore', 'inherit', 'inherit'] }); // arg arr

runRetry executes npm install automatically when dependencies are missing. Lifecycle scripts execute downloaded dependency code with user privileges without explicit confirmation.

Mittel

core/transit.template.html:994

innerHTML assignment (XSS risk)

panel.innerHTML =

The panel includes contract cards that interpolate side.confidence without escaping. A supplied contract index can inject executable HTML when its matched card opens.

Mittel

core/still.mjs:9

Temp directory access

for (const t of ts) { await p.evaluate((t) => window.renderAt(t), Number(t)); await p.screenshot({ p

Screenshots use predictable /tmp/still names without private-directory creation or exclusive writes. Another local user could precreate symlinks and redirect output writes.

Mittel

src/request-transit/adapters/fetch-posthog-api.mjs:28

Fetch API call

const r = await fetch(`${host}/api/projects/@current/`, { headers: { Authorization: `Bearer ${key}`

The configured PostHog host can use HTTP while requests attach a bearer key. Without HTTPS enforcement, nonlocal deployments can expose credentials in transit.

Mittel

src/request-transit/adapters/fetch-posthog-api.mjs:36

Fetch API call

const r = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${key}`, 'Content-Typ

The configured PostHog host can use HTTP while requests attach a bearer key. Without HTTPS enforcement, nonlocal deployments can expose credentials in transit.

Mittel

src/request-transit/adapters/fetch-tempo.mjs:35

Fetch API call

try { return await fetch(fetchBase + path, { headers }); }

Tempo accepts HTTP endpoints while attaching bearer or Basic credentials. Nonlocal plaintext connections can expose credentials and trace data to network observers.

Risikofaktoren

📁 Dateisystemzugriff (50)

core/adapters.mjs:1 core/adapters.mjs:2 core/adapters.mjs:3 core/build.mjs:11 core/build.mjs:60 core/build.mjs:115 core/build.mjs:118 core/build.mjs:119 core/build.mjs:126 core/build.mjs:14 core/build.mjs:17 core/export.mjs:29 core/fsguard.mjs:5 core/fsguard.mjs:43 core/fsguard.mjs:48 core/scrub.mjs:25 core/scrub.mjs:31 core/scrub.mjs:33 core/scrub.mjs:98 core/setup.mjs:24 core/setup.mjs:36 core/setup.mjs:126 core/setup.mjs:160 core/setup.mjs:190 core/setup.mjs:58 core/setup.mjs:81 core/setup.mjs:101 core/still.mjs:9 core/tools.mjs:8 core/tools.mjs:15 core/tools.mjs:20 core/transit.template.html:914 core/transit.template.html:1095 core/verdict.mjs:96 core/verify.mjs:8 core/verify.mjs:35 core/verify.mjs:63 core/verify.mjs:65 src/agent-transit/adapters/normalize-agent.mjs:4 src/agent-transit/adapters/normalize-agent.mjs:209 src/agent-transit/adapters/normalize-agent.mjs:6 src/agent-transit/adapters/normalize-agent.mjs:107 src/ci-transit/adapters/normalize-gh.mjs:1 src/ci-transit/adapters/normalize-gh.mjs:95 src/ci-transit/adapters/normalize-gh.mjs:3 src/ci-transit/samples/make-gh-run-sample.mjs:1 src/ci-transit/samples/make-gh-run-sample.mjs:54 src/ci-transit/scripts/fetch.mjs:2 src/ci-transit/scripts/fetch.mjs:35 src/request-transit/adapters/fetch-datadog-api.mjs:11

⚡ Enthält Skripte (14)

core/build.mjs:131 core/render.mjs:24 core/setup.mjs:92 core/still.mjs:3 core/tools.mjs:26 core/transit.template.html:804 core/transit.template.html:986 core/transit.template.html:987 core/transit.template.html:994 core/verify.mjs:17 src/request-transit/adapters/normalize.mjs:289 src/request-transit/adapters/normalize.mjs:293 src/request-transit/contracts/extractors/openapi.mjs:1 src/request-transit/contracts/extractors/protobuf.mjs:60

⚙️ Externe Befehle (50)

core/build.mjs:53 core/build.mjs:61 core/build.mjs:62 core/build.mjs:66 core/build.mjs:67 core/build.mjs:73 core/build.mjs:80 core/build.mjs:95 core/build.mjs:96 core/build.mjs:114 core/build.mjs:117 core/build.mjs:118 core/build.mjs:124 core/build.mjs:137 core/build.mjs:138 core/cli.mjs:17 core/cli.mjs:32 core/export.mjs:14 core/export.mjs:33 core/export.mjs:69 core/export.mjs:28 core/export.mjs:31 core/export.mjs:36 core/export.mjs:42 core/export.mjs:50 core/export.mjs:56 core/export.mjs:58 core/export.mjs:66 core/export.mjs:79 core/export.mjs:83 core/export.mjs:86 core/fsguard.mjs:16 core/fsguard.mjs:20 core/fsguard.mjs:28 core/fsguard.mjs:48 core/render-frames.mjs:42 core/render-frames.mjs:84 core/render-frames.mjs:87 core/render-frames.mjs:88 core/render.mjs:5 core/render.mjs:31 core/render.mjs:30 core/scrub.mjs:34 core/scrub.mjs:43 core/scrub.mjs:46 core/scrub.mjs:74 core/setup.mjs:23 core/setup.mjs:34 core/setup.mjs:48 core/setup.mjs:5

🔑 Umgebungsvariablen (50)

🌐 Netzwerkzugriff (27)

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/israelvicars-ci-transit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/israelvicars-ci-transit/security.svg)](https://skillstore.io/skills/israelvicars-ci-transit?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/israelvicars-ci-transit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/israelvicars-ci-transit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/israelvicars-ci-transit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

israelvicars. (2026). ci-transit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/israelvicars-ci-transit/audits/1

BibTeX-Zitat

@techreport{israelvicars-israelvicars-ci-transit-2026,
  author = {israelvicars},
  title = {ci-transit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/israelvicars-ci-transit/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ci-transit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "israelvicars"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/israelvicars-ci-transit/audits/1"
identifiers:
  - type: other
    value: "skillstore:israelvicars-ci-transit:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Inspect a Failed Pipeline

Map a failed workflow run to identify unsuccessful steps and compare their timing with neighboring work.

Review CI Scheduling

Inspect job timing, idle periods, and supplied dependency links to discuss pipeline scheduling changes.

Prepare an Incident Artifact

Create a reviewed local HTML map or animation for an incident discussion without uploading private run data automatically.

Diese Prompts ausprobieren

Map a Saved Run

Use ci-transit to map ./run.json as a local HTML file. Identify failed or cancelled steps. Do not fetch data or install dependencies.

Inspect the Latest Failure

Fetch the latest failed GitHub Actions run for [owner/repo] on [branch]. Build its map and report failed steps. Keep all outputs local.

Prepare a Sharing Artifact

Build ./run.json with strict sharing mode into ./transit-out/review.html. Check identifiers and visible labels for sensitive data. Report the verdict without uploading anything.

Render and Verify Full Timing

Render ./run.json with every step and uncompressed timing. Ask before downloading dependencies. Export GIF and MP4, run bundled verification, and report paths and failures.

Bewährte Praktiken

Use synthetic runs for demonstrations and review strict-mode output, including identifiers, before sharing.
Choose dedicated output directories and approve dependency downloads before rendering on restricted machines.
Preserve all steps and wall-clock timing when investigating delays; use compressed views only for presentation.

Vermeiden

Assuming automatic redaction guarantees that every private value is removed.
Uploading private CI artifacts or expanding access without explicit authorization.
Treating service alerts or compressed animation duration as a complete root-cause analysis.