{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-danger-x-to-markdown",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Invokes unreleased or reverse-engineered private APIs / spoofs client identifiers"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Involves bypassing automated detection, disabling host sandboxes, or skipping SSL certificate validation"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user login states and session cookies"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: cookies: auth_token, ct0 (required), optionally gt, twid; sources = env (X_AUTH_TOKEN / X_CT0 / X_GUEST)"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: scripts/main.ts (executed via bun; launches/attaches to Chrome debugging sessions on demand to read cookies)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: https://x.com/i/api/graphql/<queryId>/<Operation> (TweetResultByRestId / Twe)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: x-to-markdown/{username}/{tweet-id}/{content-slug}.md (or path specified by -o)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全量清单：scripts 下 19 个文件（main/graphql/cookies/media-localizer/thread/thread-markdown/tweet-to-markdown/tweet-article/referenced-tweets/markdown/constants/http/paths/types + 两个 test + package.json + bun.lock），逐项核对无遗漏脚本；② 端点重扫：单独 grep 全目录 URL，得到 x.com / pbs.twimg.com / video.twimg.com 与 frontmatter homepage，与 security.network_calls 一致；③ 凭据面穷举：grep X_AUTH_TOKEN/X_CT0/cookie/CDP/Network.getCookies，确认三源加载顺序与必需项 X_REQUIRED_COOKIES；④ 反查“是否更严重”：检查 rejectUnauthorized/--ignore-certificate/NODE_TLS 与 webdriver/patchright/stealth（均零命中）、是否有批量抓取循环（无，单 URL 入口）、是否有 eval/远程代码（无）；⑤ 与同仓库 baoyu-post-to-x 的技术路线对比，确认本 skill 的 red 定级依据是“逆向私有 API”与“客户端冒充”而非“读 cookie”本身；⑥ 功能声明核对：description 的 tweet/article → markdown 与 YAML front matter 均有对应实现文件。",
    "second_pass": [
      {
        "item": "逆向 GraphQL 请求 + 客户端冒充（red 主因）",
        "status": "ok",
        "detail": "graphql.ts 从首页 HTML 抓 queryId/featureSwitches，拼 https://x.com/i/api/graphql/${queryId}/Operation；constants.ts 提供 FALLBACK_QUERY_ID 与硬编码 bearer/UA。"
      },
      {
        "item": "浏览 cookie 读取",
        "status": "ok",
        "detail": "cookies.ts：buildInlineCookiesFromEnv 读 X_AUTH_TOKEN/X_CT0/X_GUEST_TOKEN/X_TWID；loadXCookiesFromFile 读本地文件；loadXCookiesFromCdp 经 CDP 取；hasRequiredXCookies 校验 auth_token 与 ct0。"
      },
      {
        "item": "媒体下载范围",
        "status": "ok",
        "detail": "media-localizer.ts 仅对 pbs.twimg.com / video.twimg.com 判定类型并 fetch 下载，且只在 --download-media 路径调用（SKILL.md 的三态策略）。"
      },
      {
        "item": "两道用户门禁",
        "status": "ok",
        "detail": "SKILL.md：consent.json（accepted + disclaimerVersion 1.0）与 EXTEND.md 首次设置（三问，禁止静默默认），后者被单独标为 BLOCKING。"
      },
      {
        "item": "无 TLS 降级 / 无 stealth 伪装 / 无任意代码执行",
        "status": "ok",
        "detail": "相关 token 全目录零命中；入口是单个 URL；无 eval/动态 import 远程模块。"
      },
      {
        "item": "与 baoyu-post-to-x 的路线差异（避免档位观感不一致）",
        "status": "ok",
        "detail": "post-to-x 走真实 UI + CDP 自动化（另行定级）；本 skill 走私有 API 伪造请求 → red。差异来源是技术路线，已在 reason 写明。"
      },
      {
        "item": "meta 元数据",
        "status": "ok",
        "detail": "GitHub API：MIT、25926 stars、pushed_at 2026-09-10T15:13:43Z；本地 HEAD 与 pin 1567581c26ec… 一致。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "bb27420994157cc51ab3fe8eada14f0965d776be383d7362c5321ad895561418",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-danger-x-to-markdown.tar.gz",
    "sha256": "bb27420994157cc51ab3fe8eada14f0965d776be383d7362c5321ad895561418",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-danger-x-to-markdown",
    "path": "skills/baoyu-danger-x-to-markdown",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}