phrazzld/agent-transcript
skills/agent-transcript/SKILL.md
Redact and package local agent-session excerpts for PRs, issues, receipts, or review evidence. Use when: "add agent transcript", "attach session proof", "show agent provenance", "redact transcript", "PR transcript". Trigger: /agent-transcript.
$ install --global
skillsauthnpx skillsauth add phrazzld/spellbook agent-transcriptInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 3, 2026, 2:26 AM135.6s2 files scanned
SKILL.md
- name:
- agent-transcript
- description:
- |
- or review evidence. Use when:
- add agent transcript", "attach session
- Trigger:
- /agent-transcript.
- argument-hint:
- [render|preview] [session-log-or-text]
/agent-transcript
Package agent provenance without leaking the session.
Inspired by Peter Steinberger's agent-transcript contract: transcript
evidence is useful only when it is scoped, redacted, optional, and reviewable
before it leaves the machine.
Contract
- Never upload raw logs.
- Never include system/developer prompts, raw tool output, secrets, cookies, auth URLs, broad local paths, or environment dumps.
- Ask before adding transcript evidence to a public PR or issue body.
- Fail closed when unresolved secrets remain.
- Keep only user intent, assistant-visible decisions, terse tool summaries, commands/tests run, and proof outcomes.
- Scope excerpts to the current PR/issue/branch/ticket; omit unrelated turns.
- Use a collapsed
<details>block with stable markers so reruns update rather than duplicate the section. - Best effort only: PR/issue creation continues when no safe transcript exists.
Helper
Use the self-contained redactor for local previews:
python3 skills/agent-transcript/scripts/agent_transcript.py render \
--input /path/to/session.log \
--title "Agent Transcript" \
--output /tmp/agent-transcript.md
Smoke test:
python3 skills/agent-transcript/scripts/agent_transcript.py --self-test
The helper reads plain text or JSONL-ish logs from stdin or --input. It writes
sanitized Markdown only. It performs no network calls and does not edit GitHub
bodies; callers pass the rendered block through the repo's normal PR/issue
body-file flow after human approval.
Workflow
- Identify scope: branch name, ticket/PR title, changed files, and goal.
- Pick the smallest useful session excerpt.
- Render locally with the helper.
- Inspect the output for remaining secrets or unrelated turns.
- If public insertion is desired, ask explicitly and use a temp body file.
- Include the transcript path or PR section in the final receipt.
Output Shape
<!-- harness-kit-agent-transcript:start -->
<details>
<summary>Agent Transcript</summary>
...
</details>
<!-- harness-kit-agent-transcript:end -->
Gotchas
- Raw transcripts are evidence-shaped secrets. Render first, inspect second, publish only after approval.
- Redaction is not summarization. Remove unrelated turns instead of hiding them
behind broad
[REDACTED]blocks. - Public GitHub writes should use
--body-file; never inline shell-expanded transcript text. - A clean helper exit proves only the rendered file passed the redaction scan, not that the excerpt is relevant or appropriate.
Related Skills
phrazzld/debrief
development
VerifiedTrustedCommunity
Lightweight evidence-backed retro and catch-up reports for a current repo, branch, PR, backlog slice, or recent agent session. Use when the user asks for a debrief, catch me up, what changed, why it matters, product implications, end-user implications, developer experience implications, current app state, backlog state, workspace state, alternatives considered, or context rebuild after losing the thread. Trigger: /debrief.
13SKILL.mdUpdated Jun 5, 2026
phrazzld/trace
testing
VerifiedTrustedCommunity
Capture agent-session work records as local JSONL audit evidence. Links a backlog/spec, branch, commits, review verdicts, QA/demo evidence, transcript refs, and shipped ref without storing raw private transcripts. Use when: "trace this work", "write work record", "agent session trace", "journal this delivery", "link transcript evidence". Trigger: /trace, /journal.
13SKILL.mdUpdated Jun 4, 2026
phrazzld/skillify
data-ai
VerifiedTrustedCommunity
Turn proven agent-session patterns into first-party Harness Kit skills. Use when: "skillify this conversation", "make this into a skill", "generate a skill from current transcript", "extract reusable workflow". Trigger: /skillify.
13SKILL.mdUpdated Jun 4, 2026
phrazzld/critique
testing
VerifiedTrustedCommunity
Run one targeted, read-only architecture or quality critique through a named lens from the shared rubric. Use when: "critique this module", "run an Ousterhout pass", "lens critique", "architecture critique". Trigger: /critique.
13SKILL.mdUpdated Jun 4, 2026