{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-post-to-weibo",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "external_write",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Calling undocumented or reverse-engineered private APIs / spoofing client identifiers"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Involves bypassing automation detection, disabling host sandbox, or skipping SSL certificate validation"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reading or reusing browser user login state and session cookies"
    },
    {
      "file": "scripts/",
      "summary": "Executing local scripts or commands: bun {baseDir}/scripts/weibo-post.ts <text> --image/--video …"
    },
    {
      "file": "外部 API",
      "summary": "Publishing posts, creating, or modifying resources on external platforms"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Chrome profile directory (default baoyu-skills/chrome-profile hierarchy, persisting login session and browser data)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全目录清单（SKILL.md、scripts/ 8 个文件含 bun.lock 与 package.json，无 references）；② 判红反查：grep bypass|synthetic|detect|automation|webdriver|stealth 命中三处（SKILL.md 首段、weibo-utils.ts 的 extraArgs、paste-from-clipboard.ts 的自述），再核对 paste 助手是否真被调用（weibo-utils.ts 的 runBunScript + weibo-article.ts 的 copyHtmlToClipboard/pasteFromClipboard 调用链）——确认为第一手段，而 CDP 合成事件只是 fallback；③ 端点反查：grep https:// 只落到 weibo.com 与 card.weibo.com（编辑器），无第三方外发域名；④ 凭证反查：grep process.env / API_KEY / TOKEN / .env / cookie 零命中（无密钥文件读取），凭证面确为浏览器 profile 会话；⑤ 进程操作面核对：killChromeByProfile 读 ps aux 后 process.kill(SIGTERM)，匹配条件含 profileDir；⑥ 反向确认无其他红线：grep no-sandbox / rejectUnauthorized / insecure 零命中；⑦ 元数据核对：HEAD=1567581c26ec、LICENSE=MIT、stars 25926、pushed_at=2026-09-10T15:13:43Z。",
    "second_pass": [
      {
        "item": "反自动化检测绕过（判红主因）",
        "status": "ok",
        "detail": "三处证据互相印证：SKILL.md 'bypasses anti-bot detection'；weibo-utils.ts `extraArgs: ['--disable-blink-features=AutomationControlled', '--start-maximized'],`（launchChrome 传给 launchChromeBase）；paste-from-clipboard.ts 'This bypasses CDP's synthetic events which websites can detect and ignore.'"
      },
      {
        "item": "真实按键是第一手段而非兜底",
        "status": "ok",
        "detail": "weibo-article.ts 注释排序为 '// Method 1: Copy HTML to system clipboard, then real paste keystroke'，失败后才走 DataTransfer paste 事件；图片替换循环直接 pasteFromClipboard('Google Chrome', 5, 1000)。"
      },
      {
        "item": "凭证面确认（无密钥读取，靠 profile 会话）",
        "status": "ok",
        "detail": "全目录 process.env/API_KEY/TOKEN/SECRET/.env 扫描零命中；SKILL.md 说明登录态由 Chrome profile 持久化（First run: log in to Weibo manually (session saved)），EXTEND.md 仅支持默认 profile 一项。"
      },
      {
        "item": "外部端点仅微博自家域名",
        "status": "ok",
        "detail": "grep https:// 命中 WEIBO_HOME_URL=https://weibo.com/ 与 WEIBO_ARTICLE_URL=https://card.weibo.com/article/v3/editor，另有一处仅作日志措辞的 'src: https://...'；无第三方 API/CDN。"
      },
      {
        "item": "平台限制与自检",
        "status": "ok",
        "detail": "MAX_FILES=18、TITLE_MAX_LENGTH=32、SUMMARY_MAX_LENGTH=44 均在源码；SKILL.md 的 Post-Composition Check（剩余 WBIMGPH_ 占位符、预期 vs 实际图片数）与代码校验逻辑一致。"
      },
      {
        "item": "进程清理不会误杀用户浏览器",
        "status": "ok",
        "detail": "killChromeByProfile 只对同时包含 profileDir 与 '--remote-debugging-port=' 的行取 pid 并 SIGTERM；SKILL.md 用 CRITICAL 明确禁止 `pkill -f \"Google Chrome\"`。"
      },
      {
        "item": "无其他安全降级",
        "status": "ok",
        "detail": "grep no-sandbox / rejectUnauthorized / --insecure / NODE_TLS_REJECT / disable-web-security 零命中；Chrome 参数仅为调试端口、profile、AutomationControlled 与最大化窗口。"
      },
      {
        "item": "元数据（license/stars/commit）",
        "status": "ok",
        "detail": "git HEAD=1567581c26ec29f4216c6e6835415bf30343b0e3；仓库根 LICENSE=MIT（Copyright (c) 2026 Jim Liu）；GitHub API stars=25926、pushed_at=2026-09-10T15:13:43Z。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "5673e558aeace4cc2e72b99f68367275fb0c429a7c2bb151b190e9d788a95efd",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-post-to-weibo.tar.gz",
    "sha256": "5673e558aeace4cc2e72b99f68367275fb0c429a7c2bb151b190e9d788a95efd",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-post-to-weibo",
    "path": "skills/baoyu-post-to-weibo",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}