Trace Debuger

End-to-end trace debugging from trace_id. Fetch Jaeger trace and Elasticsearch logs, analyze possible bugs (optionally with local repository context), and ge...

Security Scan

The skill mostly does what it claims (fetch Jaeger traces and ES logs and analyze them), but there are several inconsistencies and operational details that are not declared and raise risk (undisclosed CLI dependency, a hard-coded example repo path, a strict one-message upload + delete workflow that can hide traces).

Purpose & Capability

The name/description (trace debugging via Jaeger + Elasticsearch + optional repository context) matches the script's behavior. However, the SKILL.md and script expect an external 'codex' analysis step (runs a codex CLI/subprocess) and access to local repository files, yet the registry metadata declares no required binaries or environment variables. The default repo_path in SKILL.md points to a specific absolute user path (/Users/noodles/...) which is unusual for a generic skill and may be a leftover from development.

Instruction Scope

SKILL.md instructs the agent to run the included Python script, fetch traces from jaeger_url and logs from es_url, and optionally scan a local repo. It also mandates that the generated Markdown file be sent to the user as ONE chat message with a strict caption format and then deleted locally. That strict single-message upload + deletion step could be used to obfuscate data transfer and reduces auditability. The instructions instruct running 'codex exec' (or equivalent) against repository and logs, which will send code/log data to an external tool/service.

Install Mechanism

There is no install spec (instruction-only), which minimizes disk writes. However, the runtime flow relies on an external CLI ('codex') invoked via subprocess. The skill metadata does not declare this required binary—this mismatch is a practical omission (the skill will fail or behave differently if codex is not present).

Credentials

The skill declares no required environment variables, but it will access network endpoints (jaeger_url, es_url) and arbitrary local files under the provided repo_path. If the codex CLI sends data to an external service, analysis results and repository contents could leave the host. The default absolute repo_path is a red flag (points to a particular user's Desktop). No authentication handling for ES/Jaeger is declared (these services often require credentials), so users might supply credentials ad hoc or the script might be run against local, unauthenticated endpoints.

Persistence & Privilege

The skill does not request permanent presence (always:false) and does not modify other skill configs. It writes a local Markdown file and explicitly instructs deletion afterwards; the deletion behavior itself is not privileged but combined with the one-message upload requirement reduces leftover artifacts for inspection.

What to consider before installing

Before installing or running this skill: (1) Understand it will read any files under the provided repo_path and send logs+code to an external 'codex' tool invoked by subprocess — confirm what 'codex' does and where it sends data. (2) The skill metadata does not declare the 'codex' CLI as a required binary or any auth variables for ES/Jaeger — expect manual setup or failures. (3) Avoid providing paths to sensitive repositories; run first in a sandbox or VM with limited network access. (4) If you need to use it with private Jaeger/ES, verify how credentials are supplied and that you trust the external analysis service. (5) Consider inspecting or running the included script locally to confirm behavior (and remove or change the hard-coded example repo_path) before granting it access to real data.

Use this skill to generate a self-contained Markdown trace debug report.

Inputs

• trace_id (required)
• jaeger_url (optional, default http://127.0.0.1:16686)
• es_url (optional, default http://127.0.0.1:9200)
• repo_path (optional, absolute path, default /Users/noodles/Desktop/code/go-components/examples/tracer)
• output_path (optional, default ./trace_debug_report_{trace_id}.md)
• es_index (optional, default filebeat-tracer-*)
• es_size (optional, default 2000)

Run

python3 skills/trace_debuger/scripts/trace_debuger.py \
  --trace-id <TRACE_ID> \
  [--jaeger-url http://127.0.0.1:16686] \
  [--es-url http://127.0.0.1:9200] \
  [--repo-path /Users/noodles/Desktop/code/go-components/examples/tracer] \
  [--output-path ./trace_debug_report_<TRACE_ID>.md]

Output

• Writes Markdown report to output_path
• MUST send the generated Markdown report to the user as a file attachment via the chat window in the same session before finishing the task
• MUST send the report as ONE chat message only: attach the Markdown file and put the strict summary block in the same message caption/body.
• 【markdown报告文件】 is a placeholder and MUST be replaced with the real uploaded Markdown filename (example: trace_debug_report_<trace_id>.md).
• Use exactly this format in caption/body:

<真实markdown报告文件名>
trace_id: xxxx
status: xxx
jaeger_url: xxx
es_url: xxx
代码仓库路径：仓库路径
关键结论摘要：xxxx

• Prints fixed summary lines to stdout:

trace_id: <trace_id>
status: SUCCESS/FAIL
jaeger_url: <jaeger_url>
es_url: <es_url>
代码仓库路径：<repo_path|N/A>
关键结论摘要：<summary>

Notes

• Keep logs sorted by timestamp ascending.
• After fetching ES logs, run Codex in repository root (automated via codex exec equivalent to TUI paste workflow) with this prompt:
  • 这是我的日志，请根据日志结合代码帮我排查分析bug，输出bug原因及解决方案,必须保持固定的格式。
• If repository is provided, include code-context hints and file matches for suspected bug areas.
• If repository is not provided, base bug hypotheses on logs + spans only.
• After analysis in chat workflow: send the generated Markdown report as a file attachment to the user through the chat window, with the strict summary block in the same message caption/body (single message only).
• The first line must be the real Markdown filename (not placeholder text).
• Finally, delete the local Markdown file.