Habilidades request-transit

📦

request-transit

Name: request-transit
Author: israelvicars

Revisión del contenido r1 Riesgo alto 📁 Acceso al sistema de archivos⚡ Contiene scripts⚙️ Comandos externos🔑 Variables de entorno🌐 Acceso a red

Visualize Distributed Requests as Transit Maps

Distributed traces can make service dependencies and failures difficult to explain. Request Transit turns exported spans into interactive maps and optional videos for incident reviews.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "request-transit" from https://skillstore.io/skills/israelvicars-request-transit.md and its manifest at https://skillstore.io/api/skills/israelvicars-request-transit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/israelvicars-request-transit.md Manifest firmado GET /api/skills/israelvicars-request-transit/manifest Lockfile firmado GET /api/skills/israelvicars-request-transit/lockfile

Pruébalo

Usando "request-transit". A synthetic checkout trace containing an email-service failure.

Resultado esperado:

An interactive map highlights the email failure as a service alert.
The selected hop shows its timing and the SMTP timeout message.
The hop table lists infrastructure and unmatched calls.

Usando "request-transit". A trace export requested as review media after prerequisite approval.

Resultado esperado:

An HTML map, MP4 video, GIF animation, and contact sheet are written locally.
Verification reports frame comparisons, train timing, and blank-frame checks.
Any rendering or verification failure is reported without substitute media.

Usando "request-transit". A trace and an approved contract index from service source repositories.

Resultado esperado:

Matched hops show expected request and response fields with source references.
Unresolved schemas and infrastructure hops remain explicitly identified.

Auditoría de seguridad

Riesgo alto

v1 • 22/10/2026 Abrir el informe versionado

Adjudicated all 400 supplied findings; most are lexical false positives or documented local processing. Credentialed PostHog and Tempo requests allow plaintext HTTP; share-mode serialization also preserves unredacted fields. No evidence found of malicious intent; 447 omitted static matches still require manual review. Static review was capped at 400/847 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Archivos escaneados

11,156

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

core/scrub.mjs:82 core/scrub.mjs:99-109 src/request-transit/adapters/normalize.mjs:437-447 core/build.mjs:83-84 core/build.mjs:117-120 SKILL.md:45-56

Share Mode Preserves Sensitive Data Outside Scrubbed Fields

Share mode labels output for sharing but embeds the entire validated internal trace. Event objects, extra span fields, and metadata can retain private values. The sharing workflow can therefore disclose data that is absent from the visible map.

A local strict-mode test retained email addresses inside an event object, extra span field, and metadata. Internal validation preserves these fields, and build serializes the full trace.

Elementos de revisión de capacidades (3)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

src/request-transit/adapters/fetch-posthog-api.mjs:28

Fetch API call

const r = await fetch(`${host}/api/projects/@current/`, { headers: { Authorization: `Bearer ${key}`

src/request-transit/adapters/fetch-posthog-api.mjs:28: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

Medio

src/request-transit/adapters/fetch-posthog-api.mjs:36

Fetch API call

const r = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${key}`, 'Content-Typ

src/request-transit/adapters/fetch-posthog-api.mjs:36: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

Medio

src/request-transit/adapters/fetch-tempo.mjs:35

Fetch API call

try { return await fetch(fetchBase + path, { headers }); }

src/request-transit/adapters/fetch-tempo.mjs:35: Tempo attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

Factores de riesgo

📁 Acceso al sistema de archivos (50)

core/adapters.mjs:1 core/adapters.mjs:2 core/adapters.mjs:3 core/build.mjs:11 core/build.mjs:60 core/build.mjs:115 core/build.mjs:118 core/build.mjs:119 core/build.mjs:126 core/build.mjs:14 core/build.mjs:17 core/export.mjs:29 core/fsguard.mjs:5 core/fsguard.mjs:43 core/fsguard.mjs:48 core/scrub.mjs:25 core/scrub.mjs:31 core/scrub.mjs:33 core/scrub.mjs:98 core/setup.mjs:24 core/setup.mjs:36 core/setup.mjs:126 core/setup.mjs:160 core/setup.mjs:190 core/setup.mjs:58 core/setup.mjs:81 core/setup.mjs:101 core/still.mjs:9 core/tools.mjs:8 core/tools.mjs:15 core/tools.mjs:20 core/transit.template.html:914 core/transit.template.html:1095 core/verdict.mjs:96 core/verify.mjs:8 core/verify.mjs:35 core/verify.mjs:63 core/verify.mjs:65 src/agent-transit/adapters/normalize-agent.mjs:4 src/agent-transit/adapters/normalize-agent.mjs:209 src/agent-transit/adapters/normalize-agent.mjs:6 src/agent-transit/adapters/normalize-agent.mjs:107 src/ci-transit/adapters/normalize-gh.mjs:1 src/ci-transit/adapters/normalize-gh.mjs:95 src/ci-transit/adapters/normalize-gh.mjs:3 src/request-transit/adapters/fetch-datadog-api.mjs:11 src/request-transit/adapters/fetch-datadog-api.mjs:37 src/request-transit/adapters/fetch-posthog-api.mjs:13 src/request-transit/adapters/fetch-posthog-api.mjs:50 src/request-transit/adapters/fetch-tempo.mjs:12

⚡ Contiene scripts (14)

core/build.mjs:131 core/render.mjs:24 core/setup.mjs:92 core/still.mjs:3 core/tools.mjs:26 core/transit.template.html:804 core/transit.template.html:986 core/transit.template.html:987 core/transit.template.html:994 core/verify.mjs:17 src/request-transit/adapters/normalize.mjs:289 src/request-transit/adapters/normalize.mjs:293 src/request-transit/contracts/extractors/openapi.mjs:1 src/request-transit/contracts/extractors/protobuf.mjs:60

⚙️ Comandos externos (50)

core/build.mjs:53 core/build.mjs:61 core/build.mjs:62 core/build.mjs:66 core/build.mjs:67 core/build.mjs:73 core/build.mjs:80 core/build.mjs:95 core/build.mjs:96 core/build.mjs:114 core/build.mjs:117 core/build.mjs:118 core/build.mjs:124 core/build.mjs:137 core/build.mjs:138 core/cli.mjs:17 core/cli.mjs:32 core/export.mjs:14 core/export.mjs:33 core/export.mjs:69 core/export.mjs:28 core/export.mjs:31 core/export.mjs:36 core/export.mjs:42 core/export.mjs:50 core/export.mjs:56 core/export.mjs:58 core/export.mjs:66 core/export.mjs:79 core/export.mjs:83 core/export.mjs:86 core/fsguard.mjs:16 core/fsguard.mjs:20 core/fsguard.mjs:28 core/fsguard.mjs:48 core/render-frames.mjs:42 core/render-frames.mjs:84 core/render-frames.mjs:87 core/render-frames.mjs:88 core/render.mjs:5 core/render.mjs:31 core/render.mjs:30 core/scrub.mjs:34 core/scrub.mjs:43 core/scrub.mjs:46 core/scrub.mjs:74 core/setup.mjs:23 core/setup.mjs:34 core/setup.mjs:48 core/setup.mjs:5

🔑 Variables de entorno (50)

🌐 Acceso a red (50)

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/israelvicars-request-transit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg)](https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/israelvicars-request-transit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

israelvicars. (2026). request-transit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/israelvicars-request-transit/audits/1

Cita BibTeX

@techreport{israelvicars-israelvicars-request-transit-2026,
  author = {israelvicars},
  title = {request-transit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/israelvicars-request-transit/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "request-transit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "israelvicars"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/israelvicars-request-transit/audits/1"
identifiers:
  - type: other
    value: "skillstore:israelvicars-request-transit:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Explain a Failed Request

Map a failing checkout trace to compare service hops, timing, and the earliest reported error.

Prepare an Incident Review

Create an interactive trace map and optional animation for an incident timeline after reviewing all embedded data.

Compare Hops With Declared Contracts

Index approved service repositories and display matched schemas, infrastructure hops, and unresolved request or response definitions.

Prueba estos prompts

Build a Local Trace Map

Build an interactive HTML map from trace.json in ./transit-out/. Use the bundled renderer. Do not fetch remote data, download dependencies, or upload results.

Inspect Slow and Failed Hops

Analyze trace.json and build a map with a 200 ms slow threshold. Report failed hops, missing spans, and observed timing. Do not infer missing payloads.

Render Review Media

Check rendering prerequisites without downloads. After approval, create HTML, MP4, GIF, and a contact sheet from trace.json. Run reproducibility checks and report failures.

Add Approved Source Contracts

With my approval, index the service repositories configured in transit.config.json. Build trace.json with contracts. Report matched, fallback, infrastructure, and unmatched hops. Keep outputs local.

Mejores prácticas

Use share mode and inspect all embedded HTML data before distributing an artifact; visual inspection alone does not establish complete redaction.
Use HTTPS endpoints and narrowly scoped credentials supplied through environment variables, not prompts.
Obtain explicit approval before source indexing or dependency downloads, and keep generated artifacts in a dedicated output directory.

Evitar

Share unredacted exports or assume strict scrubbing removes every sensitive embedded field.
Place API keys in prompts, trace fixtures, or committed configuration files.
Treat inferred infrastructure, missing spans, or unresolved contracts as verified request payloads.

Preguntas frecuentes

Which trace sources are supported?

Supported JSON inputs include OTLP, Datadog, PostHog Distributed Tracing, AWS X-Ray, Grafana Tempo, and Jaeger v2 OTLP responses.

Does rendering require network access?

HTML rendering uses local data and bundled assets. Dependency setup and optional trace fetching use networks; MCP workflows also expose data to connected tools and models.

What is required for video output?

Node 20 or newer, Playwright-compatible Chromium, and ffmpeg are required. Browser sandbox restrictions can prevent rendering.

Can the generated map be shared safely?

Use share mode, then inspect the full embedded data. Some nested objects and extra fields can retain sensitive values despite strict scrubbing.

Does the skill read my source code automatically?

Source indexing is optional and requires explicit approval. Contract matching requires an existing index and an explicit contracts option.

Are request and response payloads recovered from traces?

No. Optional contract indexing displays expected schemas from source definitions. Missing contracts remain unresolved rather than being invented.