技能 pr-walkthrough

📦

pr-walkthrough

Name: pr-walkthrough
Author: warpdotdev

內容修訂 r1 中風險 ⚡ 包含腳本⚙️ 外部命令🌐 網路存取📁 檔案系統存取

Explore Pull Requests with Interactive D3 Maps

Complex pull requests are difficult to understand from diffs alone. This skill creates a validated visual walkthrough of architecture, data flow, dependencies, and user actions.

支援: Claude Codex Code(CC)

📊 67 尚可

Maintain this Skill? Claim it 📊 67 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "pr-walkthrough" from https://skillstore.io/skills/warpdotdev-pr-walkthrough.md and its manifest at https://skillstore.io/api/skills/warpdotdev-pr-walkthrough/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/warpdotdev-pr-walkthrough.md 已簽名 manifest GET /api/skills/warpdotdev-pr-walkthrough/manifest 已簽名 lockfile GET /api/skills/warpdotdev-pr-walkthrough/lockfile

測試它

正在使用「pr-walkthrough」。 Create a compact walkthrough for the pull request on this branch.

預期結果:

A local interactive walkthrough with four switchable views, guided tours, linked evidence, and a completed browser validation result.

正在使用「pr-walkthrough」。 Help reviewers understand how this feature moves data through the system.

預期結果:

A concise subsystem overview for architectural orientation.
A directed data-flow map linked to relevant pull request evidence.
A guided sequence explaining state ownership and rendered outcomes.

正在使用「pr-walkthrough」。 Prepare a walkthrough for a large cross-layer pull request.

預期結果:

A validated visual guide covering architecture, dependencies, user actions, specifications, review comments, and important areas for reviewer inspection.

安全審計

中風險

v1 • 2026/9/4 開啟版本化報告

Most static alerts are false positives caused by JavaScript template literals, Markdown formatting, keyboard events, CSS, and normal D3 rendering. Confirmed risks are unsanitized link schemes in dynamic detail HTML and the third-party D3 runtime dependency. PR descriptions and comments also require stronger prompt-injection boundaries.

已掃描檔案

1,081

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

SKILL.md:69-75

Untrusted PR Content Enters the Agent Context

The workflow imports pull request bodies and human or agent comments as source material. It limits code-change instructions but does not reject other embedded override or tool-use requests.

The collection and use of external comments is explicit, and line 75 provides only a partial trust-boundary rule. Prompt injection remains possible through other instructions in that content.

能力複核項目 (3)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

scripts/d3_canvas_runtime.py:162

innerHTML assignment (XSS risk)

panel.innerHTML = `

Dynamic text is escaped, but URL values are inserted into href attributes without a scheme allowlist. An attacker-influenced javascript: URL could execute when a reviewer clicks it.

低

scripts/d3_canvas_runtime.py:13

Hardcoded URL

D3_CDN_URL = f"https://cdn.jsdelivr.net/npm/d3@{D3_VERSION}/dist/d3.min.js"

Generated walkthroughs load executable D3 code from jsDelivr at runtime. The version is pinned, but the remote script lacks a documented integrity check.

低

SKILL.md:19

Hardcoded URL

- `https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js`

The instructions require generated pages to load D3 from a third-party CDN. This creates an intentional network and remote-code supply-chain dependency.

風險因素

⚡ 包含腳本 (2)

scripts/d3_canvas_runtime.py:155 scripts/d3_canvas_runtime.py:162

⚙️ 外部命令 (50)

🌐 網路存取 (10)

scripts/d3_canvas_runtime.py:13 scripts/validate_d3_canvas.py:70 scripts/validate_d3_canvas.py:71 SKILL.md:17 SKILL.md:121 SKILL.md:226 SKILL.md:19 SKILL.md:127 SKILL.md:269 SKILL.md:273

📁 檔案系統存取 (1)

scripts/d3_canvas_runtime.py:289

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg)](https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/warpdotdev-pr-walkthrough?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/warpdotdev-pr-walkthrough/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/warpdotdev-pr-walkthrough.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

warpdotdev. (2026). pr-walkthrough security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1

BibTeX 引用

@techreport{warpdotdev-warpdotdev-pr-walkthrough-2026,
  author = {warpdotdev},
  title = {pr-walkthrough security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-walkthrough security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "warpdotdev"
date-released: "2026-09-04"
url: "https://skillstore.io/skills/warpdotdev-pr-walkthrough/audits/1"
identifiers:
  - type: other
    value: "skillstore:warpdotdev-pr-walkthrough:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Orient a pull request reviewer

Create a compact visual guide before reviewing a change across several related files.

Explain subsystem impact

Show how a proposed change connects architecture, data movement, dependencies, and visible behavior.

Prepare an implementation walkthrough

Generate a navigable artifact for discussing a pull request with distributed collaborators.

試試這些提示

Create a basic walkthrough

Create an interactive walkthrough for the pull request on my current branch. Keep it compact and validate the generated canvas.

Focus on reviewer orientation

Build a PR walkthrough for my current branch. Emphasize the stable subsystem architecture and the smallest set of concepts needed for review.

Trace behavior across the change

Generate the four PR walkthrough views. Prioritize data movement, dependency direction, user actions, changed specifications, and existing review discussion.

Create and publish a validated walkthrough

Create a detailed walkthrough for pull request [number]. Validate every view, then publish through approved protected hosting without exposing private repository content.

最佳實務

Use the full current files and adjacent modules to establish architectural context.
Keep each view focused on distinct reviewer questions and the smallest useful node set.
Validate every graph, tour, control, link, and browser-rendered state before sharing.

避免

Do not treat the walkthrough as a substitute for code review findings.
Do not build architecture explanations from diff hunks alone.
Do not publish private pull request content without explicit approval and suitable access controls.

常見問題

What does this skill create?

It creates a static interactive HTML walkthrough with four D3 views and guided reviewer tours.

Does it review the code?

No. It explains the change and surrounding architecture without generating new approval recommendations or review findings.

Can the walkthrough run without a development server?

Yes. The output opens from a local file URL, although D3 normally loads from a pinned CDN.

What repository information does it use?

It uses pull request metadata, diffs, current source files, changed specifications, tests, review comments, and relevant visual assets.

How is the result validated?

The included validator checks required graphs and controls, then uses Playwright to verify browser rendering and interactions.

Can I publish the walkthrough?

Yes, after explicit approval. Use protected hosting for private code and confirm that the artifact contains no sensitive information.

開發者詳細資訊

作者

warpdotdev

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/warpdotdev/common-skills/tree/b811c24365ae505bfc9646458957b886e29110b5/.agents/skills/pr-walkthrough

引用

e5464e662405de6361fdde6b984f9ea865635f64

維護新鮮度

2026/9/8

使用量

1 次下載 · 0 次瀏覽

檔案結構

📁 scripts/

📄 d3_canvas_runtime.py

📄 validate_d3_canvas.py

📄 SKILL.md