スキル request-transit

📦

request-transit

Name: request-transit
Author: israelvicars

コンテンツリビジョン r1 高リスク 📁 ファイルシステムへのアクセス⚡ スクリプトを含む⚙️ 外部コマンド🔑 環境変数🌐 ネットワークアクセス

Visualize Distributed Requests as Transit Maps

Distributed traces can make service dependencies and failures difficult to explain. Request Transit turns exported spans into interactive maps and optional videos for incident reviews.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "request-transit" from https://skillstore.io/skills/israelvicars-request-transit.md and its manifest at https://skillstore.io/api/skills/israelvicars-request-transit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/israelvicars-request-transit.md 署名済み manifest GET /api/skills/israelvicars-request-transit/manifest 署名済み lockfile GET /api/skills/israelvicars-request-transit/lockfile

テストする

「request-transit」を使用しています。 A synthetic checkout trace containing an email-service failure.

期待される結果:

An interactive map highlights the email failure as a service alert.
The selected hop shows its timing and the SMTP timeout message.
The hop table lists infrastructure and unmatched calls.

「request-transit」を使用しています。 A trace export requested as review media after prerequisite approval.

期待される結果:

An HTML map, MP4 video, GIF animation, and contact sheet are written locally.
Verification reports frame comparisons, train timing, and blank-frame checks.
Any rendering or verification failure is reported without substitute media.

「request-transit」を使用しています。 A trace and an approved contract index from service source repositories.

期待される結果:

Matched hops show expected request and response fields with source references.
Unresolved schemas and infrastructure hops remain explicitly identified.

セキュリティ監査

高リスク

v1 • 2026/10/22 バージョン別レポートを開く

Adjudicated all 400 supplied findings; most are lexical false positives or documented local processing. Credentialed PostHog and Tempo requests allow plaintext HTTP; share-mode serialization also preserves unredacted fields. No evidence found of malicious intent; 447 omitted static matches still require manual review. Static review was capped at 400/847 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

スキャンされたファイル

11,156

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

高

core/scrub.mjs:82 core/scrub.mjs:99-109 src/request-transit/adapters/normalize.mjs:437-447 core/build.mjs:83-84 core/build.mjs:117-120 SKILL.md:45-56

Share Mode Preserves Sensitive Data Outside Scrubbed Fields

Share mode labels output for sharing but embeds the entire validated internal trace. Event objects, extra span fields, and metadata can retain private values. The sharing workflow can therefore disclose data that is absent from the visible map.

A local strict-mode test retained email addresses inside an event object, extra span field, and metadata. Internal validation preserves these fields, and build serializes the full trace.

機能レビュー項目 (3)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中

src/request-transit/adapters/fetch-posthog-api.mjs:28

Fetch API call

const r = await fetch(`${host}/api/projects/@current/`, { headers: { Authorization: `Bearer ${key}`

src/request-transit/adapters/fetch-posthog-api.mjs:28: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

中

src/request-transit/adapters/fetch-posthog-api.mjs:36

Fetch API call

const r = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${key}`, 'Content-Typ

src/request-transit/adapters/fetch-posthog-api.mjs:36: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

中

src/request-transit/adapters/fetch-tempo.mjs:35

Fetch API call

try { return await fetch(fetchBase + path, { headers }); }

src/request-transit/adapters/fetch-tempo.mjs:35: Tempo attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

リスク要因

📁 ファイルシステムへのアクセス (50)

core/adapters.mjs:1 core/adapters.mjs:2 core/adapters.mjs:3 core/build.mjs:11 core/build.mjs:60 core/build.mjs:115 core/build.mjs:118 core/build.mjs:119 core/build.mjs:126 core/build.mjs:14 core/build.mjs:17 core/export.mjs:29 core/fsguard.mjs:5 core/fsguard.mjs:43 core/fsguard.mjs:48 core/scrub.mjs:25 core/scrub.mjs:31 core/scrub.mjs:33 core/scrub.mjs:98 core/setup.mjs:24 core/setup.mjs:36 core/setup.mjs:126 core/setup.mjs:160 core/setup.mjs:190 core/setup.mjs:58 core/setup.mjs:81 core/setup.mjs:101 core/still.mjs:9 core/tools.mjs:8 core/tools.mjs:15 core/tools.mjs:20 core/transit.template.html:914 core/transit.template.html:1095 core/verdict.mjs:96 core/verify.mjs:8 core/verify.mjs:35 core/verify.mjs:63 core/verify.mjs:65 src/agent-transit/adapters/normalize-agent.mjs:4 src/agent-transit/adapters/normalize-agent.mjs:209 src/agent-transit/adapters/normalize-agent.mjs:6 src/agent-transit/adapters/normalize-agent.mjs:107 src/ci-transit/adapters/normalize-gh.mjs:1 src/ci-transit/adapters/normalize-gh.mjs:95 src/ci-transit/adapters/normalize-gh.mjs:3 src/request-transit/adapters/fetch-datadog-api.mjs:11 src/request-transit/adapters/fetch-datadog-api.mjs:37 src/request-transit/adapters/fetch-posthog-api.mjs:13 src/request-transit/adapters/fetch-posthog-api.mjs:50 src/request-transit/adapters/fetch-tempo.mjs:12

⚡ スクリプトを含む (14)

core/build.mjs:131 core/render.mjs:24 core/setup.mjs:92 core/still.mjs:3 core/tools.mjs:26 core/transit.template.html:804 core/transit.template.html:986 core/transit.template.html:987 core/transit.template.html:994 core/verify.mjs:17 src/request-transit/adapters/normalize.mjs:289 src/request-transit/adapters/normalize.mjs:293 src/request-transit/contracts/extractors/openapi.mjs:1 src/request-transit/contracts/extractors/protobuf.mjs:60

⚙️ 外部コマンド (50)

core/build.mjs:53 core/build.mjs:61 core/build.mjs:62 core/build.mjs:66 core/build.mjs:67 core/build.mjs:73 core/build.mjs:80 core/build.mjs:95 core/build.mjs:96 core/build.mjs:114 core/build.mjs:117 core/build.mjs:118 core/build.mjs:124 core/build.mjs:137 core/build.mjs:138 core/cli.mjs:17 core/cli.mjs:32 core/export.mjs:14 core/export.mjs:33 core/export.mjs:69 core/export.mjs:28 core/export.mjs:31 core/export.mjs:36 core/export.mjs:42 core/export.mjs:50 core/export.mjs:56 core/export.mjs:58 core/export.mjs:66 core/export.mjs:79 core/export.mjs:83 core/export.mjs:86 core/fsguard.mjs:16 core/fsguard.mjs:20 core/fsguard.mjs:28 core/fsguard.mjs:48 core/render-frames.mjs:42 core/render-frames.mjs:84 core/render-frames.mjs:87 core/render-frames.mjs:88 core/render.mjs:5 core/render.mjs:31 core/render.mjs:30 core/scrub.mjs:34 core/scrub.mjs:43 core/scrub.mjs:46 core/scrub.mjs:74 core/setup.mjs:23 core/setup.mjs:34 core/setup.mjs:48 core/setup.mjs:5

🔑 環境変数 (50)

🌐 ネットワークアクセス (50)

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/israelvicars-request-transit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg)](https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/israelvicars-request-transit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

israelvicars. (2026). request-transit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/israelvicars-request-transit/audits/1

BibTeX形式の引用

@techreport{israelvicars-israelvicars-request-transit-2026,
  author = {israelvicars},
  title = {request-transit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/israelvicars-request-transit/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "request-transit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "israelvicars"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/israelvicars-request-transit/audits/1"
identifiers:
  - type: other
    value: "skillstore:israelvicars-request-transit:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Explain a Failed Request

Map a failing checkout trace to compare service hops, timing, and the earliest reported error.

Prepare an Incident Review

Create an interactive trace map and optional animation for an incident timeline after reviewing all embedded data.

Compare Hops With Declared Contracts

Index approved service repositories and display matched schemas, infrastructure hops, and unresolved request or response definitions.

これらのプロンプトを試す

Build a Local Trace Map

Build an interactive HTML map from trace.json in ./transit-out/. Use the bundled renderer. Do not fetch remote data, download dependencies, or upload results.

Inspect Slow and Failed Hops

Analyze trace.json and build a map with a 200 ms slow threshold. Report failed hops, missing spans, and observed timing. Do not infer missing payloads.

Render Review Media

Check rendering prerequisites without downloads. After approval, create HTML, MP4, GIF, and a contact sheet from trace.json. Run reproducibility checks and report failures.

Add Approved Source Contracts

With my approval, index the service repositories configured in transit.config.json. Build trace.json with contracts. Report matched, fallback, infrastructure, and unmatched hops. Keep outputs local.

ベストプラクティス

Use share mode and inspect all embedded HTML data before distributing an artifact; visual inspection alone does not establish complete redaction.
Use HTTPS endpoints and narrowly scoped credentials supplied through environment variables, not prompts.
Obtain explicit approval before source indexing or dependency downloads, and keep generated artifacts in a dedicated output directory.

回避

Share unredacted exports or assume strict scrubbing removes every sensitive embedded field.
Place API keys in prompts, trace fixtures, or committed configuration files.
Treat inferred infrastructure, missing spans, or unresolved contracts as verified request payloads.

よくある質問

Which trace sources are supported?

Supported JSON inputs include OTLP, Datadog, PostHog Distributed Tracing, AWS X-Ray, Grafana Tempo, and Jaeger v2 OTLP responses.

Does rendering require network access?

HTML rendering uses local data and bundled assets. Dependency setup and optional trace fetching use networks; MCP workflows also expose data to connected tools and models.

What is required for video output?

Node 20 or newer, Playwright-compatible Chromium, and ffmpeg are required. Browser sandbox restrictions can prevent rendering.

Can the generated map be shared safely?

Use share mode, then inspect the full embedded data. Some nested objects and extra fields can retain sensitive values despite strict scrubbing.

Does the skill read my source code automatically?

Source indexing is optional and requires explicit approval. Contract matching requires an existing index and an explicit contracts option.

Are request and response payloads recovered from traces?

No. Optional contract indexing displays expected schemas from source definitions. Missing contracts remain unresolved rather than being invented.