Skills distributed-debugging-debug-trace

📦

distributed-debugging-debug-trace

Name: distributed-debugging-debug-trace
Author: sickn33

Content revision r2 Critical ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Configure Distributed Debugging and Tracing

Distributed failures are difficult to reproduce and correlate across services. This skill designs debugging, tracing, logging, profiling, and production diagnostics workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "distributed-debugging-debug-trace" from https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace.md and its manifest at https://skillstore.io/api/skills/sickn33-distributed-debugging-debug-trace/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-distributed-debugging-debug-trace.md Signed manifest GET /api/skills/sickn33-distributed-debugging-debug-trace/manifest Signed lockfile GET /api/skills/sickn33-distributed-debugging-debug-trace/lockfile

Test it

Using "distributed-debugging-debug-trace". Requests fail intermittently between the gateway, checkout service, and payment service.

Expected outcome:

Trace plan: propagate one correlation identifier through all three services.
Key spans: gateway validation, checkout orchestration, payment authorization, and dependency calls.
Validation: reproduce one failure and confirm connected spans, error status, and sanitized attributes.

Using "distributed-debugging-debug-trace". The Node.js service has rising memory use after each deployment.

Expected outcome:

Baseline: record heap use, allocation rate, request volume, and deployment timestamps.
Profile plan: collect bounded heap snapshots during controlled windows.
Decision path: compare retained object groups before changing application code.

Using "distributed-debugging-debug-trace". A team needs production tracing without exposing customer information.

Expected outcome:

Collection policy: allowlist operational attributes and reject request bodies.
Sampling policy: retain errors and rare paths while limiting routine traffic.
Controls: encrypt transport, restrict access, audit queries, and enforce retention.

Security Audit

Critical

v5 • 7/23/2026 Open versioned report

Most static findings are false positives caused by JavaScript template literals, explicit configuration reads, and ordinary profiler file output. Confirmed risks include unsafe dashboard rendering and debugger exposure. The playbook also contains unauthenticated runtime evaluation and sensitive telemetry patterns that require correction before publication.

Files scanned

1,361

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

resources/implementation-playbook.md:179-255

Unauthenticated Remote Runtime Evaluation

The remote debug server accepts WebSocket messages without authentication and sends caller expressions to Runtime.evaluate. Network clients can execute code in the process.

The server directly routes unauthenticated evaluate messages to the Node.js inspector. The default all-interface binding makes remote access plausible.

High

resources/implementation-playbook.md:294-325

Sensitive Request Data Exported in Traces

The tracing example records complete request bodies, user identifiers, and session identifiers. The configured span processor exports these values to Jaeger.

The code explicitly serializes request.body and records user and session identifiers. No field allowlist or redaction occurs before export.

High

resources/implementation-playbook.md:1008-1046

Cross-Request Debug Log Capture

Production middleware replaces the process-wide console during one request. Concurrent request logs can enter another user debug context and expose sensitive data.

The console object is global, while capture state belongs to one request. Concurrent application activity can therefore be recorded in the wrong context.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

resources/implementation-playbook.md:1183

innerHTML assignment (XSS risk)

container.innerHTML = `

The dashboard inserts WebSocket-supplied metrics into innerHTML without encoding. A crafted payload can execute script in the dashboard origin.

High

resources/implementation-playbook.md:1195

innerHTML assignment (XSS risk)

entry.innerHTML = `

The dashboard inserts WebSocket-supplied trace fields into innerHTML without encoding. A crafted payload can execute script in the dashboard origin.

High

resources/implementation-playbook.md:1208

innerHTML assignment (XSS risk)

entry.innerHTML = `

The dashboard inserts WebSocket-supplied log fields into innerHTML without encoding. A crafted payload can execute script in the dashboard origin.

High

resources/implementation-playbook.md:182

Hardcoded IP address

this.host = options.host || '0.0.0.0';

The example binds the Node.js inspector or remote debug service to all network interfaces. Exposed debugger access can permit arbitrary runtime evaluation.

High

resources/implementation-playbook.md:268

Hardcoded IP address

ENV NODE_OPTIONS="--inspect=0.0.0.0:9229"

The example binds the Node.js inspector or remote debug service to all network interfaces. Exposed debugger access can permit arbitrary runtime evaluation.

High

resources/implementation-playbook.md:269

Hardcoded IP address

CMD ["node", "--inspect-brk=0.0.0.0:9229", "index.js"]

The example binds the Node.js inspector or remote debug service to all network interfaces. Exposed debugger access can permit arbitrary runtime evaluation.

Medium

resources/implementation-playbook.md:1163

WebSocket connection

const ws = new WebSocket('ws://localhost:9231/debug');

The dashboard accepts unauthenticated plaintext WebSocket data and passes it to rendering functions. This permits local data injection and interception.

Risk Factors

⚡ Contains scripts (3)

resources/implementation-playbook.md:1183 resources/implementation-playbook.md:1195 resources/implementation-playbook.md:1208

⚙️ External commands (31)

🌐 Network access (9)

resources/implementation-playbook.md:315 resources/implementation-playbook.md:388 resources/implementation-playbook.md:1163 resources/implementation-playbook.md:294 resources/implementation-playbook.md:898 resources/implementation-playbook.md:899 resources/implementation-playbook.md:182 resources/implementation-playbook.md:268 resources/implementation-playbook.md:269

📁 Filesystem access (7)

resources/implementation-playbook.md:681 resources/implementation-playbook.md:713 resources/implementation-playbook.md:737 resources/implementation-playbook.md:680 resources/implementation-playbook.md:713 resources/implementation-playbook.md:737 resources/implementation-playbook.md:56

🔑 Env variables (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-distributed-debugging-debug-trace/security.svg)](https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-distributed-debugging-debug-trace/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-distributed-debugging-debug-trace.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). distributed-debugging-debug-trace security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace/audits/5

BibTeX citation

@techreport{sickn33-sickn33-distributed-debugging-debug-trace-2026,
  author = {sickn33},
  title = {distributed-debugging-debug-trace security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "distributed-debugging-debug-trace security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-distributed-debugging-debug-trace/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-distributed-debugging-debug-trace:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Trace a Microservice Failure

Map request flow, define spans, and correlate logs for a failure crossing several services.

Standardize Team Debugging

Create consistent IDE, logging, source map, and profiling practices for a development team.

Diagnose Production Latency

Plan sampled tracing and profiling that limits overhead and protects sensitive data.

Try These Prompts

Set Up Local Debugging

Create a local debugging setup for [runtime and framework]. Include IDE configuration, source maps, test debugging, and validation steps.

Design Distributed Tracing

Design tracing for [services and protocols]. Define propagation, key spans, standard attributes, sampling, export, redaction, and coverage tests.

Investigate a Production Incident

Analyze this incident evidence: [logs, traces, symptoms, and timeline]. Correlate signals, rank hypotheses, and propose low-risk diagnostic steps.

Build a Secure Debugging Platform

Create a production debugging architecture for [environment]. Include authentication, authorization, encryption, audit logs, data minimization, sampling, retention, and emergency controls.

Best Practices

Define a diagnostic question before increasing log detail, trace sampling, or profiler duration.
Allowlist telemetry fields and redact secrets, credentials, tokens, and personal data before export.
Test trace continuity, access controls, overhead, retention, and shutdown behavior before production rollout.

Avoid

Do not expose runtime evaluation, inspectors, heap snapshots, or debug routes without strong authentication and network isolation.
Do not record complete request bodies, session identifiers, or arbitrary objects in logs and traces.
Do not use verbose production debugging without sampling, time limits, audit records, and rollback controls.

Frequently Asked Questions

Which systems benefit most from this skill?

Multi-service applications with difficult correlation, intermittent failures, or incomplete observability benefit most.

Does the skill require OpenTelemetry?

No. The playbook emphasizes OpenTelemetry, but its workflow can be adapted to other tracing systems.

Can it diagnose a live production incident?

It can analyze supplied evidence and propose steps. It needs authorized access and environment details for direct investigation.

How should sensitive data be handled?

Use field allowlists, redaction, encryption, restricted access, short retention, and audits for all diagnostic data.

Will tracing affect performance?

Tracing adds overhead. Measure baselines, sample traffic, limit attributes, batch exports, and validate under representative load.

Are the playbook examples production ready?

No. Adapt and test them, especially remote debugging, telemetry collection, dashboard rendering, authentication, and error handling.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/distributed-debugging-debug-trace

Ref

f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526

Maintenance freshness

7/26/2026

Usage

7 downloads · 128 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md

More from sickn33

View all

📦

content-creator

Create Brand-Consistent Marketing Content

Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.

Writing & Content View

📦

prompt-engineering-patterns

Improve LLM Prompts With Proven Patterns

Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.

Productivity View

📦

senior-fullstack

Build Fullstack Apps with Senior Patterns

Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.

Coding & Development View

📦

senior-architect

Design Scalable Software Architectures

Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.

Coding & Development View

📦

prompt-engineer

Optimize AI Prompts With Prompt Engineer

Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.

Productivity View

📦

product-manager-toolkit

Prioritize Product Work With Research Insights

Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.

Productivity View

View all

📦

distributed-tracing

Implement Distributed Tracing

by wshobson

Distributed systems hide where latency and errors begin. This skill guides tracing setup, instrumentation, sampling, and analysis across services.

DevOps & Infrastructure View

📦

appinsights-instrumentation

Instrument Apps with Azure Application Insights

by microsoft

Application teams need consistent telemetry setup across languages and Azure hosting services. This skill provides targeted SDK, infrastructure, environment, and query guidance for Application Insights.

DevOps & Infrastructure View

📦

otel-expert

Answer OpenTelemetry Questions With Sources

by ANcpLua

OpenTelemetry work often requires exact semantic conventions and configuration details. This skill searches bundled OTel documentation and returns sourced guidance for instrumentation, collector setup, and OTLP decisions.

DevOps & Infrastructure View

📦

Observability & Monitoring

Implement Observability and Monitoring

by ArieGoldkin

Production systems need logs, metrics, traces, alerts, and health checks that work together. This skill gives Claude, Codex, and Claude Code practical templates for service observability.

DevOps & Infrastructure View

📦

python-observability-patterns

Add Python Observability Patterns

by 0xDarkMatter

Python services often lack consistent logging, metrics, and tracing patterns. This skill provides practical structlog, Prometheus, and OpenTelemetry examples for production applications.

DevOps & Infrastructure View

📦

project-operator

Operate Local Project Stacks Safely

by ACSKamloops

Local development stacks can be hard to debug when logs, services, and config changes are handled out of order. This skill guides Claude, Codex, and Claude Code to inspect evidence first and explain safe operational steps.

DevOps & Infrastructure View

distributed-debugging-debug-trace

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Trace a Microservice Failure

Standardize Team Debugging

Diagnose Production Latency

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from sickn33

content-creator

prompt-engineering-patterns

senior-fullstack

senior-architect

prompt-engineer

product-manager-toolkit

Related Skills

distributed-tracing

appinsights-instrumentation

otel-expert

Observability & Monitoring

python-observability-patterns

project-operator