{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-url-to-markdown",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Calls undocumented or reverse-engineered private APIs / spoofs client identifiers"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Contains logic to bypass automation detection, disable host sandboxing, or skip SSL certificate validation"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user login states and session cookies"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: reads x.com/twitter.com cookies via CDP Network.getCookies, requiring auth_token and ct0 to be present"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: {baseDir}/scripts/baoyu-fetch <url> … (shell exec bun → lib/cli.ts; requires bun i on first run)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: user-specified target URLs (real browser pages; generic pages routed through Readability/Defuddle/defuddle.md)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: markdown/JSON specified by --output (parent directories created automatically)"
    }
  ],
  "verification": {
    "method": "第一遍：本人通读 SKILL.md（171 行）与 references/adapters.md、quality-gate.md，并按文件树理解 50 个源文件的职责。第二遍：独立只读 scout 逐文件（40 个 TS/JSON/包装脚本）扫描 import、spawn、URL 常量、cookie 与写盘路径，核对适配器行为、CDP 客户端实现、网络日志与调试落盘、以及是否读 Chrome 的 Cookies SQLite；构建脚本对每条 evidence.quote 在 pin 源码上做空白归一化逐字断言。",
    "second_pass": [
      {
        "item": "YouTube 适配器的逆向/冒充",
        "status": "ok",
        "detail": "transcript.ts 有 window.ytcfg?.data_?.INNERTUBE_API_KEY、页面内 POST /youtubei/v1/player?key=…（credentials: 'include'）与 context.client.clientName='ANDROID' 三处，与 Main 终裁的『逆向 youtubei ＋ 冒充官方客户端』一致。"
      },
      {
        "item": "X cookie 明文 sidecar 落盘",
        "status": "ok",
        "detail": "cookie-sidecar.ts 用 Network.getCookies 取 cookie 后 JSON.stringify 明文写入 <profile>/x-session-cookies.json（x/index.ts 指定 filename），无加密无 chmod；convert.ts 在开头尝试回灌、finally 里导出。"
      },
      {
        "item": "接管已运行调试会话",
        "status": "ok",
        "detail": "profile.ts 解析 DevToolsActivePort 并 spawnSync('ps', ['aux']) 匹配 profileDir + --remote-debugging-port；chrome-launcher.ts 支持 --cdp-url ws:// 直连与复用日志 'Reusing Chrome debugger at …'。"
      },
      {
        "item": "网络日志含请求头与响应体（--debug-dir 落盘）",
        "status": "ok",
        "detail": "network-journal.ts 记录 requestHeaders / requestBody / 响应体（Network.getResponseBody），convert.ts 在写 debug 前调用 toJSON({ includeBodies: true }) 并写入 network.json。"
      },
      {
        "item": "第三方 defuddle.md 兜底",
        "status": "ok",
        "detail": "DEFUDDLE_API_ORIGIN=https://defuddle.md，构建 URL 后 fetch；通用适配器仅在 outputFormat==='markdown' 时启用该兜底，JSON 模式不会外发目标 URL。"
      },
      {
        "item": "文档与实现不一致（默认无头）",
        "status": "discrepancy",
        "detail": "SKILL.md 第 93 行写 '# Default: headless capture, markdown to stdout'、quality-gate.md 亦写 'Default | Headless Chrome'，但 cli.ts 默认 headless: false（convert.ts 在非交互模式传该值），实际会启动可见 Chrome（--no-startup-window）。使用前应知道默认并非无头。"
      },
      {
        "item": "文档与实现不一致（默认 profile 路径）",
        "status": "discrepancy",
        "detail": "SKILL.md 写默认 ./baoyu-skills/chrome-profile，代码实际解析为按 OS 的绝对路径（XDG_DATA_HOME / Application Support / APPDATA 下的 baoyu-skills/chrome-profile），从不使用 cwd 相对路径。"
      },
      {
        "item": "文档未披露 cookie 导出",
        "status": "discrepancy",
        "detail": "SKILL.md 只写 BAOYU_CHROME_PROFILE_DIR 为『Chrome user data directory』，从未提及会导出 X cookie 到 sidecar 文件；该行为只在代码中可见——这是本次侦查中风险披露落差最大的一处。"
      },
      {
        "item": "jsdom 是否执行页面脚本",
        "status": "ok",
        "detail": "jsdom 未启用 runScripts，页面脚本不在 Node 内执行；脚本执行限于真实 Chrome 页面内的 Runtime.evaluate（injection_surface 已据此描述）。"
      },
      {
        "item": "档位复核（批4 终裁）",
        "status": "ok",
        "detail": "按 Main 终裁判 red：逆向 youtubei＋客户端冒充（与 youtube-transcript 同构）＋凭证明文 sidecar＋调试会话接管；orange 级要件（cookie 用于声明用途、URL 送 defuddle.md）作为程度说明写进 reason。"
      },
      {
        "item": "元数据与 pin",
        "status": "ok",
        "detail": "本地 HEAD = 1567581c26ec29f4216c6e6835415bf30343b0e3（2026-09-10 10:13:43 -0500）；GitHub API MIT / 25926 stars / pushed_at 2026-09-10T15:13:43Z；仓库根 LICENSE 为 MIT。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "15be54497a8d6c302c35e214cce4b1fc9639ce98e0b0075d48418f952ff81ba0",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-url-to-markdown.tar.gz",
    "sha256": "15be54497a8d6c302c35e214cce4b1fc9639ce98e0b0075d48418f952ff81ba0",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-url-to-markdown",
    "path": "skills/baoyu-url-to-markdown",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}