📦

pr-walkthrough

Name: pr-walkthrough
Author: warpdotdev

Inhaltsrevision r1 Mittleres Risiko ⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff

Explore Pull Requests with Interactive D3 Maps

Complex pull requests are difficult to understand from diffs alone. This skill creates a validated visual walkthrough of architecture, data flow, dependencies, and user actions.

Unterstützt: Claude Codex Code(CC)

📊 67 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "pr-walkthrough" from https://skillstore.io/skills/warpdotdev-pr-walkthrough.md and its manifest at https://skillstore.io/api/skills/warpdotdev-pr-walkthrough/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/warpdotdev-pr-walkthrough.md Signiertes manifest GET /api/skills/warpdotdev-pr-walkthrough/manifest Signiertes lockfile GET /api/skills/warpdotdev-pr-walkthrough/lockfile

Testen

„pr-walkthrough“ wird verwendet. Create a compact walkthrough for the pull request on this branch.

Erwartetes Ergebnis:

A local interactive walkthrough with four switchable views, guided tours, linked evidence, and a completed browser validation result.

„pr-walkthrough“ wird verwendet. Help reviewers understand how this feature moves data through the system.

Erwartetes Ergebnis:

A concise subsystem overview for architectural orientation.
A directed data-flow map linked to relevant pull request evidence.
A guided sequence explaining state ownership and rendered outcomes.

„pr-walkthrough“ wird verwendet. Prepare a walkthrough for a large cross-layer pull request.

Erwartetes Ergebnis:

A validated visual guide covering architecture, dependencies, user actions, specifications, review comments, and important areas for reviewer inspection.

Sicherheitsaudit

Mittleres Risiko

v1 • 4.9.2026 Versionsbericht öffnen

Most static alerts are false positives caused by JavaScript template literals, Markdown formatting, keyboard events, CSS, and normal D3 rendering. Confirmed risks are unsanitized link schemes in dynamic detail HTML and the third-party D3 runtime dependency. PR descriptions and comments also require stronger prompt-injection boundaries.

Gescannte Dateien

1,081

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

SKILL.md:69-75

Untrusted PR Content Enters the Agent Context

The workflow imports pull request bodies and human or agent comments as source material. It limits code-change instructions but does not reject other embedded override or tool-use requests.

The collection and use of external comments is explicit, and line 75 provides only a partial trust-boundary rule. Prompt injection remains possible through other instructions in that content.

Elemente der Fähigkeitsprüfung (3)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

scripts/d3_canvas_runtime.py:162

innerHTML assignment (XSS risk)

panel.innerHTML = `

Dynamic text is escaped, but URL values are inserted into href attributes without a scheme allowlist. An attacker-influenced javascript: URL could execute when a reviewer clicks it.

Niedrig

scripts/d3_canvas_runtime.py:13

Hardcoded URL

D3_CDN_URL = f"https://cdn.jsdelivr.net/npm/d3@{D3_VERSION}/dist/d3.min.js"

Generated walkthroughs load executable D3 code from jsDelivr at runtime. The version is pinned, but the remote script lacks a documented integrity check.

Niedrig

SKILL.md:19

Hardcoded URL

- `https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js`

The instructions require generated pages to load D3 from a third-party CDN. This creates an intentional network and remote-code supply-chain dependency.

Risikofaktoren

⚡ Enthält Skripte (2)

scripts/d3_canvas_runtime.py:155 scripts/d3_canvas_runtime.py:162

⚙️ Externe Befehle (50)

🌐 Netzwerkzugriff (10)

scripts/d3_canvas_runtime.py:13 scripts/validate_d3_canvas.py:70 scripts/validate_d3_canvas.py:71 SKILL.md:17 SKILL.md:121 SKILL.md:226 SKILL.md:19 SKILL.md:127 SKILL.md:269 SKILL.md:273

📁 Dateisystemzugriff (1)

scripts/d3_canvas_runtime.py:289

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg)](https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/warpdotdev-pr-walkthrough.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

warpdotdev. (2026). pr-walkthrough security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1

BibTeX-Zitat

@techreport{warpdotdev-warpdotdev-pr-walkthrough-2026,
  author = {warpdotdev},
  title = {pr-walkthrough security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-walkthrough security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "warpdotdev"
date-released: "2026-09-04"
url: "https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1"
identifiers:
  - type: other
    value: "skillstore:warpdotdev-pr-walkthrough:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Orient a pull request reviewer

Create a compact visual guide before reviewing a change across several related files.

Explain subsystem impact

Show how a proposed change connects architecture, data movement, dependencies, and visible behavior.

Prepare an implementation walkthrough

Generate a navigable artifact for discussing a pull request with distributed collaborators.

Diese Prompts ausprobieren

Create a basic walkthrough

Create an interactive walkthrough for the pull request on my current branch. Keep it compact and validate the generated canvas.

Focus on reviewer orientation

Build a PR walkthrough for my current branch. Emphasize the stable subsystem architecture and the smallest set of concepts needed for review.

Trace behavior across the change

Generate the four PR walkthrough views. Prioritize data movement, dependency direction, user actions, changed specifications, and existing review discussion.

Create and publish a validated walkthrough

Create a detailed walkthrough for pull request [number]. Validate every view, then publish through approved protected hosting without exposing private repository content.

Bewährte Praktiken

Use the full current files and adjacent modules to establish architectural context.
Keep each view focused on distinct reviewer questions and the smallest useful node set.
Validate every graph, tour, control, link, and browser-rendered state before sharing.

Vermeiden

Do not treat the walkthrough as a substitute for code review findings.
Do not build architecture explanations from diff hunks alone.
Do not publish private pull request content without explicit approval and suitable access controls.

Häufig gestellte Fragen

What does this skill create?

It creates a static interactive HTML walkthrough with four D3 views and guided reviewer tours.

Does it review the code?

No. It explains the change and surrounding architecture without generating new approval recommendations or review findings.

Can the walkthrough run without a development server?

Yes. The output opens from a local file URL, although D3 normally loads from a pinned CDN.

What repository information does it use?

It uses pull request metadata, diffs, current source files, changed specifications, tests, review comments, and relevant visual assets.

How is the result validated?

The included validator checks required graphs and controls, then uses Playwright to verify browser rendering and interactions.

Can I publish the walkthrough?

Yes, after explicit approval. Use protected hosting for private code and confirm that the artifact contains no sensitive information.

Entwicklerdetails

Autor

warpdotdev

Lizenz

MIT

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/warpdotdev/common-skills/tree/b811c24365ae505bfc9646458957b886e29110b5/.agents/skills/pr-walkthrough

Ref.

e5464e662405de6361fdde6b984f9ea865635f64

Aktualität der Wartung

8.9.2026

Nutzung

1 Downloads · 0 Aufrufe

Dateistruktur

📁 scripts/

📄 d3_canvas_runtime.py

📄 validate_d3_canvas.py

📄 SKILL.md