{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "archify",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: node bin/archify.mjs <validate|deliver|preview|compare|migrate|inspect|chec"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: GET https://tt-a1i.github.io/archify/skill-updates/archify/stable.json —— f"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Delivered artifacts and sidecars: <output.html> and co-located receipt/contact-sheet/screenshots (deliver "
    }
  ],
  "verification": {
    "method": "第二遍独立复核（换角度抓第一遍的错）：① 不用第一遍结论，重新按 SKILL.md 依赖面列文件树（skill 目录 214 个受版本控制文件、8.5MB），核对 schemas/renderers/bin/scripts/references/test 的实际存在与规模；② 逐条外部依赖回源码找调用点：更新 manifest 常量、品牌抓取传输层、git 取证、Chrome 探测；③ 全目录字面量扫描 http(s):// 与 fetch/child_process/process.env，逐一归类，找第一遍漏掉的网络面；④ 凭证面反查：grep api_key|secret|password|token|keychain|.netrc|.ssh|bearer|authorization 于可执行目录，命中项全部是「拒绝带凭证的 URL」类判断而非读取；⑤ 实跑冒烟：doctor（13 项全 ok）、validate showcase（9 checks + 0/0）、brands 查询；⑥ 功能声明 vs 实际能力核对（描述里每项能力都能在源码或实跑中兑现）；⑦ commit/许可/星标与 GitHub API 及本地 HEAD 三方对数。",
    "second_pass": [
      {
        "item": "SKILL.md 声明的 9 项 showcase 检查真实存在",
        "status": "ok",
        "detail": "实跑 validate architecture examples/web-app.architecture.json --quality showcase --json：ok:true，checks 恰 9 项且全 ok:true，composition.errors=0 / warnings=0，与 SKILL.md 第 28 行「must report all 9 artifact checks with 0 composition errors and 0 warnings」逐字对应。"
      },
      {
        "item": "更新检查只读、不下载不安装",
        "status": "ok",
        "detail": "check-update.mjs 只有 fetch GET(candidate manifest)、有界读取与本地状态文件写入，无下载/解包/执行路径；SKILL.md 第 44 行明文承诺 'never downloads, installs, or executes an update'；fetchCandidate 首行即断言 manifestUrl === DEFAULT_MANIFEST_URL。"
      },
      {
        "item": "固定外发端点只有一个",
        "status": "ok",
        "detail": "http(s) 字面量扫描后，可执行代码里的外发目标仅 DEFAULT_MANIFEST_URL（scripts/update-contract.mjs:3 = https://tt-a1i.github.io/archify/skill-updates/archify/stable.json）；其余 http 命中为 docs/许可声明/品牌 source 元数据/data-URI、以及 preview 的 127.0.0.1。"
      },
      {
        "item": "品牌抓取的 SSRF 防护成立",
        "status": "ok",
        "detail": "validateUrlShape 拒绝非 HTTP(S)、带凭证 URL、非标准端口、localhost/.local；resolveRequestTarget 对解析出的每个地址做 isPrivateBrandAddress 检查；requestPinned 在 transport.request 的 lookup 中直接返回已校验地址，注释明说是为 'closes the DNS-rebinding gap'；ARCHIFY_BRAND_ALLOW_PRIVATE=1 才放开（默认关）。"
      },
      {
        "item": "无凭证/密钥读取",
        "status": "ok",
        "detail": "对 bin/ renderers/ scripts/ delta/ 的 api_key|secret|password|token|keychain|.netrc|.ssh|bearer|authorization 扫描：命中仅为 URL 凭证字段的反向拒绝（brand-marks.mjs:126、repository-location.mjs:24-25、open-artifact.mjs:82）与 SVG tokenizer 变量名；process.env 命中全部为行为开关（ARCHIFY_*、LOCALAPPDATA、XDG_CACHE_HOME、PROGRAMFILES）。"
      },
      {
        "item": "visual-check 的浏览器依赖与降级行为",
        "status": "ok",
        "detail": "findChrome 支持 ARCHIFY_CHROME 覆盖 + 三平台固定路径 + linux 命令探测；不可用时 receipt.status='skipped'、exit code 2（EXIT.skipped）、诊断 viewer/chrome-unavailable，绝不谎报通过。本环境未装 Chrome，故本报告未做浏览器证据冒烟（已如实标注）。"
      },
      {
        "item": "repository evidence 的 git 调用与路径校验",
        "status": "ok",
        "detail": "runGit 用 spawnSync('git', ['-C', repoRoot, ...])（maxBuffer 16MiB）；verifiedSourcePath 拒绝绝对路径、反斜杠、控制字符，只接受 repo-relative POSIX 路径。"
      },
      {
        "item": "预览服务器只在 loopback",
        "status": "ok",
        "detail": "bin/preview.mjs:13 `const loopbackHost = '127.0.0.1'`，server.listen(0, loopbackHost)；bin/open-artifact.mjs 拒绝非 http/非 127.0.0.1/带端口之外形状的 URL。"
      },
      {
        "item": "许可与第三方素材披露",
        "status": "ok",
        "detail": "仓库根 LICENSE（MIT，Copyright (c) 2026 tt-a1i）+ THIRD_PARTY_NOTICES.md 披露 Simple Icons 16.28.0（CC0 集合但逐项许可不一，Vue 为 CC-BY-NC-SA-4.0）与 JetBrains Mono（OFL 1.1，许可全文随包 assets/JetBrainsMono-OFL.txt）。"
      },
      {
        "item": "元数据与 pin 一致",
        "status": "ok",
        "detail": "本地 git HEAD = d673e8300df60a5c8166abe78787fdc78f6b8000，remote = github.com/tt-a1i/archify；GitHub API：MIT、stargazers 63070、pushed_at 2026-09-15T08:27:46Z、默认分支 main。"
      },
      {
        "item": "官方描述的每一项能力都可兑现",
        "status": "ok",
        "detail": "五类图、内联 SVG、明暗主题、可选 trace 动效、PNG/JPEG/WebP/SVG/WebM 导出、Mermaid 三方言入参、仓库取证：分别对应 schemas×6、assets/template.html+renderers、viewer 运行时、delta/export 路径、SKILL.md Mermaid 段、repository-evidence.mjs；无夸大项。"
      },
      {
        "item": "技能包内是否要求安装依赖",
        "status": "ok",
        "detail": "SKILL.md 'No install is required inside the skill package.'；本机实跑 `node bin/archify.mjs doctor` 13 项全 ok（未 npm install），devDependencies 仅仓库开发用。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d673e8300df60a5c8166abe78787fdc78f6b8000",
    "sha256": "6a2bea3e072ab6aa683397dc13cd3bbfcd0dbe591fd0039661beec6c3761e3a0",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/archify.tar.gz",
    "sha256": "6a2bea3e072ab6aa683397dc13cd3bbfcd0dbe591fd0039661beec6c3761e3a0",
    "commit": "d673e8300df60a5c8166abe78787fdc78f6b8000"
  },
  "original": {
    "github": "https://github.com/tt-a1i/archify/tree/main/archify",
    "path": "archify",
    "commit": "d673e8300df60a5c8166abe78787fdc78f6b8000"
  }
}