技能 request-transit

📦

request-transit

Name: request-transit
Author: israelvicars

內容修訂 r1 高風險 📁 檔案系統存取⚡ 包含腳本⚙️ 外部命令🔑 環境變數🌐 網路存取

Visualize Distributed Requests as Transit Maps

Distributed traces can make service dependencies and failures difficult to explain. Request Transit turns exported spans into interactive maps and optional videos for incident reviews.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "request-transit" from https://skillstore.io/skills/israelvicars-request-transit.md and its manifest at https://skillstore.io/api/skills/israelvicars-request-transit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/israelvicars-request-transit.md 已簽名 manifest GET /api/skills/israelvicars-request-transit/manifest 已簽名 lockfile GET /api/skills/israelvicars-request-transit/lockfile

測試它

正在使用「request-transit」。 A synthetic checkout trace containing an email-service failure.

預期結果:

An interactive map highlights the email failure as a service alert.
The selected hop shows its timing and the SMTP timeout message.
The hop table lists infrastructure and unmatched calls.

正在使用「request-transit」。 A trace export requested as review media after prerequisite approval.

預期結果:

An HTML map, MP4 video, GIF animation, and contact sheet are written locally.
Verification reports frame comparisons, train timing, and blank-frame checks.
Any rendering or verification failure is reported without substitute media.

正在使用「request-transit」。 A trace and an approved contract index from service source repositories.

預期結果:

Matched hops show expected request and response fields with source references.
Unresolved schemas and infrastructure hops remain explicitly identified.

安全審計

高風險

v1 • 2026/10/22 開啟版本化報告

Adjudicated all 400 supplied findings; most are lexical false positives or documented local processing. Credentialed PostHog and Tempo requests allow plaintext HTTP; share-mode serialization also preserves unredacted fields. No evidence found of malicious intent; 447 omitted static matches still require manual review. Static review was capped at 400/847 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

已掃描檔案

11,156

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

core/scrub.mjs:82 core/scrub.mjs:99-109 src/request-transit/adapters/normalize.mjs:437-447 core/build.mjs:83-84 core/build.mjs:117-120 SKILL.md:45-56

Share Mode Preserves Sensitive Data Outside Scrubbed Fields

Share mode labels output for sharing but embeds the entire validated internal trace. Event objects, extra span fields, and metadata can retain private values. The sharing workflow can therefore disclose data that is absent from the visible map.

A local strict-mode test retained email addresses inside an event object, extra span field, and metadata. Internal validation preserves these fields, and build serializes the full trace.

能力複核項目 (3)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

src/request-transit/adapters/fetch-posthog-api.mjs:28

Fetch API call

const r = await fetch(`${host}/api/projects/@current/`, { headers: { Authorization: `Bearer ${key}`

src/request-transit/adapters/fetch-posthog-api.mjs:28: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

中

src/request-transit/adapters/fetch-posthog-api.mjs:36

Fetch API call

const r = await fetch(url, { method: 'POST', headers: { Authorization: `Bearer ${key}`, 'Content-Typ

src/request-transit/adapters/fetch-posthog-api.mjs:36: PostHog attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

中

src/request-transit/adapters/fetch-tempo.mjs:35

Fetch API call

try { return await fetch(fetchBase + path, { headers }); }

src/request-transit/adapters/fetch-tempo.mjs:35: Tempo attaches authentication headers to a configured URL without requiring HTTPS. A nonlocal HTTP endpoint exposes credentials and trace data to network interception.

風險因素

📁 檔案系統存取 (50)

core/adapters.mjs:1 core/adapters.mjs:2 core/adapters.mjs:3 core/build.mjs:11 core/build.mjs:60 core/build.mjs:115 core/build.mjs:118 core/build.mjs:119 core/build.mjs:126 core/build.mjs:14 core/build.mjs:17 core/export.mjs:29 core/fsguard.mjs:5 core/fsguard.mjs:43 core/fsguard.mjs:48 core/scrub.mjs:25 core/scrub.mjs:31 core/scrub.mjs:33 core/scrub.mjs:98 core/setup.mjs:24 core/setup.mjs:36 core/setup.mjs:126 core/setup.mjs:160 core/setup.mjs:190 core/setup.mjs:58 core/setup.mjs:81 core/setup.mjs:101 core/still.mjs:9 core/tools.mjs:8 core/tools.mjs:15 core/tools.mjs:20 core/transit.template.html:914 core/transit.template.html:1095 core/verdict.mjs:96 core/verify.mjs:8 core/verify.mjs:35 core/verify.mjs:63 core/verify.mjs:65 src/agent-transit/adapters/normalize-agent.mjs:4 src/agent-transit/adapters/normalize-agent.mjs:209 src/agent-transit/adapters/normalize-agent.mjs:6 src/agent-transit/adapters/normalize-agent.mjs:107 src/ci-transit/adapters/normalize-gh.mjs:1 src/ci-transit/adapters/normalize-gh.mjs:95 src/ci-transit/adapters/normalize-gh.mjs:3 src/request-transit/adapters/fetch-datadog-api.mjs:11 src/request-transit/adapters/fetch-datadog-api.mjs:37 src/request-transit/adapters/fetch-posthog-api.mjs:13 src/request-transit/adapters/fetch-posthog-api.mjs:50 src/request-transit/adapters/fetch-tempo.mjs:12

⚡ 包含腳本 (14)

core/build.mjs:131 core/render.mjs:24 core/setup.mjs:92 core/still.mjs:3 core/tools.mjs:26 core/transit.template.html:804 core/transit.template.html:986 core/transit.template.html:987 core/transit.template.html:994 core/verify.mjs:17 src/request-transit/adapters/normalize.mjs:289 src/request-transit/adapters/normalize.mjs:293 src/request-transit/contracts/extractors/openapi.mjs:1 src/request-transit/contracts/extractors/protobuf.mjs:60

⚙️ 外部命令 (50)

core/build.mjs:53 core/build.mjs:61 core/build.mjs:62 core/build.mjs:66 core/build.mjs:67 core/build.mjs:73 core/build.mjs:80 core/build.mjs:95 core/build.mjs:96 core/build.mjs:114 core/build.mjs:117 core/build.mjs:118 core/build.mjs:124 core/build.mjs:137 core/build.mjs:138 core/cli.mjs:17 core/cli.mjs:32 core/export.mjs:14 core/export.mjs:33 core/export.mjs:69 core/export.mjs:28 core/export.mjs:31 core/export.mjs:36 core/export.mjs:42 core/export.mjs:50 core/export.mjs:56 core/export.mjs:58 core/export.mjs:66 core/export.mjs:79 core/export.mjs:83 core/export.mjs:86 core/fsguard.mjs:16 core/fsguard.mjs:20 core/fsguard.mjs:28 core/fsguard.mjs:48 core/render-frames.mjs:42 core/render-frames.mjs:84 core/render-frames.mjs:87 core/render-frames.mjs:88 core/render.mjs:5 core/render.mjs:31 core/render.mjs:30 core/scrub.mjs:34 core/scrub.mjs:43 core/scrub.mjs:46 core/scrub.mjs:74 core/setup.mjs:23 core/setup.mjs:34 core/setup.mjs:48 core/setup.mjs:5

🔑 環境變數 (50)

🌐 網路存取 (50)

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/israelvicars-request-transit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg)](https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/israelvicars-request-transit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/israelvicars-request-transit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/israelvicars-request-transit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

israelvicars. (2026). request-transit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/israelvicars-request-transit/audits/1

BibTeX 引用

@techreport{israelvicars-israelvicars-request-transit-2026,
  author = {israelvicars},
  title = {request-transit security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/israelvicars-request-transit/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "request-transit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "israelvicars"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/israelvicars-request-transit/audits/1"
identifiers:
  - type: other
    value: "skillstore:israelvicars-request-transit:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Explain a Failed Request

Map a failing checkout trace to compare service hops, timing, and the earliest reported error.

Prepare an Incident Review

Create an interactive trace map and optional animation for an incident timeline after reviewing all embedded data.

Compare Hops With Declared Contracts

Index approved service repositories and display matched schemas, infrastructure hops, and unresolved request or response definitions.

試試這些提示

Build a Local Trace Map

Build an interactive HTML map from trace.json in ./transit-out/. Use the bundled renderer. Do not fetch remote data, download dependencies, or upload results.

Inspect Slow and Failed Hops

Analyze trace.json and build a map with a 200 ms slow threshold. Report failed hops, missing spans, and observed timing. Do not infer missing payloads.

Render Review Media

Check rendering prerequisites without downloads. After approval, create HTML, MP4, GIF, and a contact sheet from trace.json. Run reproducibility checks and report failures.

Add Approved Source Contracts

With my approval, index the service repositories configured in transit.config.json. Build trace.json with contracts. Report matched, fallback, infrastructure, and unmatched hops. Keep outputs local.

最佳實務

Use share mode and inspect all embedded HTML data before distributing an artifact; visual inspection alone does not establish complete redaction.
Use HTTPS endpoints and narrowly scoped credentials supplied through environment variables, not prompts.
Obtain explicit approval before source indexing or dependency downloads, and keep generated artifacts in a dedicated output directory.

避免

Share unredacted exports or assume strict scrubbing removes every sensitive embedded field.
Place API keys in prompts, trace fixtures, or committed configuration files.
Treat inferred infrastructure, missing spans, or unresolved contracts as verified request payloads.

常見問題

Which trace sources are supported?

Supported JSON inputs include OTLP, Datadog, PostHog Distributed Tracing, AWS X-Ray, Grafana Tempo, and Jaeger v2 OTLP responses.

Does rendering require network access?

HTML rendering uses local data and bundled assets. Dependency setup and optional trace fetching use networks; MCP workflows also expose data to connected tools and models.

What is required for video output?

Node 20 or newer, Playwright-compatible Chromium, and ffmpeg are required. Browser sandbox restrictions can prevent rendering.

Can the generated map be shared safely?

Use share mode, then inspect the full embedded data. Some nested objects and extra fields can retain sensitive values despite strict scrubbing.

Does the skill read my source code automatically?

Source indexing is optional and requires explicit approval. Contract matching requires an existing index and an explicit contracts option.

Are request and response payloads recovered from traces?

No. Optional contract indexing displays expected schemas from source definitions. Missing contracts remain unresolved rather than being invented.