{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-electron-extract",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: bun {baseDir}/scripts/main.ts (or npx -y bun …) — invocation method specified in SKILL.md"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: registry.npmjs.org: on first run, npx -y fetches @electron/asar and prettier (no package.json in this directory)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: defaults to ~/Downloads/<AppName>-electron-extract/: extracted/, extracted.unpacked/, r"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 全目录清单核对资产面（SKILL.md、scripts/main.ts、scripts/main.test.ts，无 package.json/lockfile/references）；② 对 main.ts 逐类 token 扫描（npx/spawn/spawnSync/homedir/writeFileSync/mkdirSync/node_modules/prettier/asar/forbidden）核对每条结论的调用点真实存在；③ 反查『有无凭证/网络 API』：目录内零 fetch/axios/http、零 env 读取，唯一外发来自 npx；④ 交叉核对 SKILL.md 的 Safety/Notes 段与代码行为一致（forbidden 目录、非空目录、dry-run、--json）；⑤ 元数据核对：本地 HEAD=1567581c26ec == origin/main（git rev-parse），仓库根 LICENSE=MIT，GitHub API stars=25926 / pushed_at=2026-09-10T15:13:43Z。",
    "second_pass": [
      {
        "item": "解包委托 @electron/asar（非自研）",
        "status": "ok",
        "detail": "main.ts:404 逐字为 `const args = [\"-y\", \"@electron/asar\", \"extract\", asarPath, dest];`，spawn 以 argv 数组调用，无 shell 拼接。"
      },
      {
        "item": "npx 拉取未锁版本第三方包（供应链面）",
        "status": "ok",
        "detail": "本目录无 package.json / lockfile，main.ts 内两处 npx 调用分别拉 @electron/asar 与 prettier；SKILL.md Notes 自述 'resolved on-the-fly via `npx -y`'，与代码一致。"
      },
      {
        "item": "source map 还原能力边界（需内嵌 sourcesContent）",
        "status": "ok",
        "detail": "SKILL.md 明写只在 `.js.map` 内嵌 sourcesContent 时可用，未内嵌则跳过并记 warnings；无夸大表述。"
      },
      {
        "item": "写盘护栏（/、home、cwd 拒绝；非空目录需 --force）",
        "status": "ok",
        "detail": "main.ts assertSafeOutputDir 用 `const forbidden = [root, home, cwd];`；SKILL.md Safety 段文字与代码一致。"
      },
      {
        "item": "平台支持范围（仅 macOS/Windows 自动发现）",
        "status": "ok",
        "detail": "main.ts:310-313 对非 darwin/win32 平台直接抛错要求 --asar；SKILL.md 同述，无夸大。"
      },
      {
        "item": "外部依赖清单是否完整",
        "status": "ok",
        "detail": "全目录扫描 URL/API/凭证 token 零命中；唯二第三方包为 @electron/asar 与 prettier（均经 npx），运行时 bun/npx 为宿主运行时而非依赖。"
      },
      {
        "item": "元数据（license/stars/commit）",
        "status": "ok",
        "detail": "git rev-parse HEAD=1567581c26ec29f4216c6e6835415bf30343b0e3；仓库根 LICENSE 首行 'MIT License'、'Copyright (c) 2026 Jim Liu'；GitHub API 返回 MIT / 25926 stars / 2026-09-10T15:13:43Z。"
      },
      {
        "item": "『decompile』措辞与实际能力是否相符",
        "status": "discrepancy",
        "detail": "出题/触发词里的『decompile Electron』并不等于反编译：实际是解包 + 用构建产物自带的 source map 还原 + Prettier 美化（SKILL.md 自己写明前提是 sourcesContent 存在）。判级与结论不受影响，但详情页应写清这不是字节码/压缩代码的结构化反编译。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "3d2a2257d7155c7c27250abce902485fb9e00affbfc5fa7350c5570282a332b9",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-electron-extract.tar.gz",
    "sha256": "3d2a2257d7155c7c27250abce902485fb9e00affbfc5fa7350c5570282a332b9",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-electron-extract",
    "path": "skills/baoyu-electron-extract",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}