技能 pr-walkthrough

📦

pr-walkthrough

Name: pr-walkthrough
Author: warpdotdev

内容修订 r1 中风险 ⚡ 包含脚本⚙️ 外部命令🌐 网络访问📁 文件系统访问

Explore Pull Requests with Interactive D3 Maps

Complex pull requests are difficult to understand from diffs alone. This skill creates a validated visual walkthrough of architecture, data flow, dependencies, and user actions.

支持: Claude Codex Code(CC)

📊 67 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "pr-walkthrough" from https://skillstore.io/skills/warpdotdev-pr-walkthrough.md and its manifest at https://skillstore.io/api/skills/warpdotdev-pr-walkthrough/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/warpdotdev-pr-walkthrough.md 已签名 manifest GET /api/skills/warpdotdev-pr-walkthrough/manifest 已签名 lockfile GET /api/skills/warpdotdev-pr-walkthrough/lockfile

测试它

正在使用“pr-walkthrough”。 Create a compact walkthrough for the pull request on this branch.

预期结果:

A local interactive walkthrough with four switchable views, guided tours, linked evidence, and a completed browser validation result.

正在使用“pr-walkthrough”。 Help reviewers understand how this feature moves data through the system.

预期结果:

A concise subsystem overview for architectural orientation.
A directed data-flow map linked to relevant pull request evidence.
A guided sequence explaining state ownership and rendered outcomes.

正在使用“pr-walkthrough”。 Prepare a walkthrough for a large cross-layer pull request.

预期结果:

A validated visual guide covering architecture, dependencies, user actions, specifications, review comments, and important areas for reviewer inspection.

安全审计

中风险

v1 • 2026/9/4 打开版本化报告

Most static alerts are false positives caused by JavaScript template literals, Markdown formatting, keyboard events, CSS, and normal D3 rendering. Confirmed risks are unsanitized link schemes in dynamic detail HTML and the third-party D3 runtime dependency. PR descriptions and comments also require stronger prompt-injection boundaries.

已扫描文件

1,081

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

SKILL.md:69-75

Untrusted PR Content Enters the Agent Context

The workflow imports pull request bodies and human or agent comments as source material. It limits code-change instructions but does not reject other embedded override or tool-use requests.

The collection and use of external comments is explicit, and line 75 provides only a partial trust-boundary rule. Prompt injection remains possible through other instructions in that content.

能力复核项 (3)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

scripts/d3_canvas_runtime.py:162

innerHTML assignment (XSS risk)

panel.innerHTML = `

Dynamic text is escaped, but URL values are inserted into href attributes without a scheme allowlist. An attacker-influenced javascript: URL could execute when a reviewer clicks it.

低

scripts/d3_canvas_runtime.py:13

Hardcoded URL

D3_CDN_URL = f"https://cdn.jsdelivr.net/npm/d3@{D3_VERSION}/dist/d3.min.js"

Generated walkthroughs load executable D3 code from jsDelivr at runtime. The version is pinned, but the remote script lacks a documented integrity check.

低

SKILL.md:19

Hardcoded URL

- `https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js`

The instructions require generated pages to load D3 from a third-party CDN. This creates an intentional network and remote-code supply-chain dependency.

风险因素

⚡ 包含脚本 (2)

scripts/d3_canvas_runtime.py:155 scripts/d3_canvas_runtime.py:162

⚙️ 外部命令 (50)

🌐 网络访问 (10)

scripts/d3_canvas_runtime.py:13 scripts/validate_d3_canvas.py:70 scripts/validate_d3_canvas.py:71 SKILL.md:17 SKILL.md:121 SKILL.md:226 SKILL.md:19 SKILL.md:127 SKILL.md:269 SKILL.md:273

📁 文件系统访问 (1)

scripts/d3_canvas_runtime.py:289

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg)](https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/warpdotdev-pr-walkthrough.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

warpdotdev. (2026). pr-walkthrough security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1

BibTeX 引用

@techreport{warpdotdev-warpdotdev-pr-walkthrough-2026,
  author = {warpdotdev},
  title = {pr-walkthrough security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-walkthrough security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "warpdotdev"
date-released: "2026-09-04"
url: "https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1"
identifiers:
  - type: other
    value: "skillstore:warpdotdev-pr-walkthrough:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Orient a pull request reviewer

Create a compact visual guide before reviewing a change across several related files.

Explain subsystem impact

Show how a proposed change connects architecture, data movement, dependencies, and visible behavior.

Prepare an implementation walkthrough

Generate a navigable artifact for discussing a pull request with distributed collaborators.

试试这些提示

Create a basic walkthrough

Create an interactive walkthrough for the pull request on my current branch. Keep it compact and validate the generated canvas.

Focus on reviewer orientation

Build a PR walkthrough for my current branch. Emphasize the stable subsystem architecture and the smallest set of concepts needed for review.

Trace behavior across the change

Generate the four PR walkthrough views. Prioritize data movement, dependency direction, user actions, changed specifications, and existing review discussion.

Create and publish a validated walkthrough

Create a detailed walkthrough for pull request [number]. Validate every view, then publish through approved protected hosting without exposing private repository content.

最佳实践

Use the full current files and adjacent modules to establish architectural context.
Keep each view focused on distinct reviewer questions and the smallest useful node set.
Validate every graph, tour, control, link, and browser-rendered state before sharing.

避免

Do not treat the walkthrough as a substitute for code review findings.
Do not build architecture explanations from diff hunks alone.
Do not publish private pull request content without explicit approval and suitable access controls.

常见问题

What does this skill create?

It creates a static interactive HTML walkthrough with four D3 views and guided reviewer tours.

Does it review the code?

No. It explains the change and surrounding architecture without generating new approval recommendations or review findings.

Can the walkthrough run without a development server?

Yes. The output opens from a local file URL, although D3 normally loads from a pinned CDN.

What repository information does it use?

It uses pull request metadata, diffs, current source files, changed specifications, tests, review comments, and relevant visual assets.

How is the result validated?

The included validator checks required graphs and controls, then uses Playwright to verify browser rendering and interactions.

Can I publish the walkthrough?

Yes, after explicit approval. Use protected hosting for private code and confirm that the artifact contains no sensitive information.

开发者详情

作者

warpdotdev

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/warpdotdev/common-skills/tree/b811c24365ae505bfc9646458957b886e29110b5/.agents/skills/pr-walkthrough

引用

e5464e662405de6361fdde6b984f9ea865635f64

维护新鲜度

2026/9/8

使用量

1 次下载 · 0 次浏览

文件结构

📁 scripts/

📄 d3_canvas_runtime.py

📄 validate_d3_canvas.py

构建 Claude Code 斜杠命令

由 C0ntr0lledCha0s

团队需要易于调用和审查的可重复 AI 工作流。此技能可帮助创建、更新、验证和记录 Claude Code 斜杠命令。

编码与开发查看

pr-walkthrough

使用我的智能体安装

Agent 可读资源

测试它

安全审计

已确认安全问题 (1)

风险因素

复制报告链接

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 评分

你能构建什么

Orient a pull request reviewer

Explain subsystem impact

Prepare an implementation walkthrough

试试这些提示

最佳实践

避免

常见问题

开发者详情

warpdotdev 的更多技能

council

write-product-spec

spec-driven-implementation

migrate-to-factory

respond-to-pr-comments-in-blocklist

diagnose-ci-failures

相关技能

code-reviewer

github-pr

code-analysis

gauntlet

building-agents

building-commands