{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-markdown-to-html",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: bun {baseDir}/scripts/main.ts <markdown_file> [--theme …] [--cite] [--merma"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: https://www.plantuml.com/plantuml (default, only when document contains plantuml code blocks: diagram source code is sent as a URL-encoded payload and returns diagram)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: .html with the same base name and directory as the input (renamed to .html.bak-YYYYMMDDHHMMSS before overwriting)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全目录清单（SKILL.md、scripts/main.ts、main.test.ts、bun.lock、package.json，无 references）；② 读 main.ts 全文核对流程（参数、mermaid 预处理、占位符替换、备份、JSON 输出）与 SKILL.md 一致；③ 沿依赖链下钻 packages/baoyu-md 与 packages/baoyu-chrome-cdp：grep fetch/node:http/https/spawn/Chrome 启动参数，确认（a）mermaid 用包内自带 mermaid.min.js 渲染、无 CDN；（b）plantuml 默认 serverUrl 为公共域名且被默认注册；（c）远程图片确会被下载；（d）Chrome 启动参数不含 --no-sandbox 与反检测开关；④ 反查凭证读取（本目录 token 扫描 process.env/API_KEY/TOKEN/SECRET 零命中）；⑤ 元数据核对：HEAD=1567581c26ec、LICENSE=MIT、stars 25926、pushed_at 2026-09-10T15:13:43Z。",
    "second_pass": [
      {
        "item": "共享包依赖与版本锁定",
        "status": "ok",
        "detail": "scripts/package.json 仅声明 baoyu-md ^0.1.1 与 baoyu-chrome-cdp ^0.1.1，bun.lock 有锁定条目；两包在本仓 packages/ 内有源码（psync 可读），非黑盒。"
      },
      {
        "item": "Mermaid 本地渲染且无 CDN",
        "status": "ok",
        "detail": "packages/baoyu-chrome-cdp/src/mermaid.ts 从包内 assets 读 mermaid.min.js（`if (fs.existsSync(path.join(candidate, \"mermaid.min.js\"))) return candidate;`）并注入本地页面，无外部脚本地址。"
      },
      {
        "item": "PlantUML 默认出网到公共服务器（判橙依据）",
        "status": "ok",
        "detail": "packages/baoyu-md/src/extensions/plantuml.ts 默认 serverUrl=https://www.plantuml.com/plantuml；注册于 renderer.ts 的 markedPlantUML()；本 skill 的 document.ts 路径调用 initRenderer，SKILL.md 亦将 PlantUML 列为支持特性。"
      },
      {
        "item": "远程图片会被真实下载",
        "status": "ok",
        "detail": "packages/baoyu-md/src/images.ts 的 downloadFile 使用 node:http/https + Mozilla/5.0 UA 下载并跟随 301/302；本 skill 在 hasRemoteImages 时建临时目录承接，HTML 内保留原 URL 并附 data-local-path。"
      },
      {
        "item": "本 skill 的 Chrome 启动参数无安全降级/反检测项",
        "status": "ok",
        "detail": "packages/baoyu-chrome-cdp/src/index.ts 的 launchChromeBase args 仅为 --remote-debugging-port/--user-data-dir/--no-first-run/--no-default-browser-check（+headless）；全包 grep bypass/detect/webdriver/stealth 零命中，无 --no-sandbox。"
      },
      {
        "item": "无凭证读取",
        "status": "ok",
        "detail": "本目录 token 扫描 process.env/API_KEY/TOKEN/SECRET/.env 零命中；仅 EXTEND.md 偏好文件（路径在 SKILL.md 明列）。"
      },
      {
        "item": "mermaid securityLevel: loose 的渲染面",
        "status": "ok",
        "detail": "packages/baoyu-chrome-cdp/src/mermaid.ts 以 `mermaid.initialize({ startOnLoad: false, theme: …, securityLevel: \"loose\" })` 渲染文档中的图表代码，属本地无头浏览器内执行用户文档内容；已在 injection_surface 与 verdict.risks 标注。"
      },
      {
        "item": "『微信友好』定位与实际产物",
        "status": "ok",
        "detail": "CSS 由 juice 内联（baoyu-md 依赖含 juice ^11.0.1），图片输出 localPath 供下游上传；--cite 默认关闭，与 SKILL.md 'Default: Off. Do not ask by default.' 一致。"
      },
      {
        "item": "元数据（license/stars/commit）",
        "status": "ok",
        "detail": "git HEAD=1567581c26ec29f4216c6e6835415bf30343b0e3；仓库根 LICENSE=MIT（Copyright (c) 2026 Jim Liu）；GitHub API stars=25926、pushed_at=2026-09-10T15:13:43Z。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "548cfdf151b668924ae5e671e43f9a12e8c396afb3fc6a9692ecfc0061cc2e4a",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-markdown-to-html.tar.gz",
    "sha256": "548cfdf151b668924ae5e671e43f9a12e8c396afb3fc6a9692ecfc0061cc2e4a",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-markdown-to-html",
    "path": "skills/baoyu-markdown-to-html",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}