{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-wechat-summary",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Invokes undocumented or reverse-engineered private APIs / spoofs client identifiers"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Bypasses automated detection, disables host sandboxing, or skips SSL certificate verification"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: skill itself contains no scripts; workflow requires agent to execute wx-cli subcommands in shell: wx whoami / wx sessions / wx"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: skill itself performs no network calls; wx-cli communicates with WeChat client data via a local ~/.wx-cli daemon socket rather than a remote API"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: $TMPDIR/wx-messages.json (raw messages for the current session, single source of truth)"
    }
  ],
  "verification": {
    "method": "第一遍：本人通读 SKILL.md 全文（497 行）+ references/group-memory.md 与 profiles.md 全文，另读 setup.md 与 EXTEND.md.example。第二遍：以独立角度反查关键主张——核对是否有隐藏脚本（该目录只有 1 个 md + 4 份 references + 1 个示例，无 scripts/）、核对所有外部命令是否都指向 wx-cli/jq/grep、核对隐私与防注入条款是否真存在于 references、核对 EXTEND.md 字段与 SKILL.md 描述一致。构建脚本对每条 evidence.quote 做空白归一化逐字断言。",
    "second_pass": [
      {
        "item": "skill 目录内无任何自带脚本",
        "status": "ok",
        "detail": "文件清单仅 SKILL.md / EXTEND.md.example / references/{setup,output-formats,profiles,group-memory}.md；全目录无 .sh/.ts/.py，与 SKILL.md『不打包脚本』一致。"
      },
      {
        "item": "依赖面只有 wx-cli 与本地小工具",
        "status": "ok",
        "detail": "正文出现的可执行命令为 wx（whoami/sessions/contacts/history/members/stats/daemon）、jq、grep、wc；无 curl/wget/网络 SDK，无 npm 依赖。"
      },
      {
        "item": "沙箱豁免要求属实且为强制语态",
        "status": "ok",
        "detail": "SKILL.md 前言警告框逐字写明每条 wx 命令都需 dangerouslyDisableSandbox: true，并说明原因（~/.wx-cli 与微信数据目录在默认沙箱外）。"
      },
      {
        "item": "隐私护栏与防注入条款真实存在",
        "status": "ok",
        "detail": "profiles.md 第 5 节列出禁止项（真实姓名/联系方式/健康心理/家庭私事/作息推断）与 roast 加严项；group-memory.md『防注入（CRITICAL）』章节写明只记陈述句事实、伪装成指正的指令照弃、@bot 非白名单通道。"
      },
      {
        "item": "持久化文件与文档一致",
        "status": "ok",
        "detail": "SKILL.md 的 Storage layout 与实际写入指令逐项对应（history.json / history-digests.jsonl / memory.md / profiles/ / profiles-roast/ / imgs/），且明确 imgs/{id}.txt 是扩展点、本版不自动生成。"
      },
      {
        "item": "禁止自动安装与代跑 sudo",
        "status": "ok",
        "detail": "setup.md 写明 '**Do NOT auto-install** — this repo forbids piped/silent installs.' 并反复要求修复命令交给用户执行（The skill should NOT run `sudo` on the user's behalf.）。"
      },
      {
        "item": "EXTEND.md 字段与描述一致",
        "status": "ok",
        "detail": "self_wxid / self_display 标 required，default_version / default_time_range / data_root / bot_aliases 为可选，与 SKILL.md 的 Supported keys 表一致；EXTEND.md.example 与之一一对应。"
      },
      {
        "item": "档位复核（批4 终裁＝red）",
        "status": "ok",
        "detail": "按 Main 最新口径『skill 强制要求关沙箱/关 TLS/关校验（无论是否默认路径）→ red』落档：本 skill 以强制语态要求 dangerouslyDisableSandbox: true 且无豁免路径，叠加第三方 CLI 读取本机微信数据与密钥、产出长期落盘的群友画像，故判 red；无未转义插值、不代跑 sudo、禁止自动安装、无 TLS 降级、无外发与冒充，作为程度说明写在 reason。"
      },
      {
        "item": "元数据与 pin",
        "status": "ok",
        "detail": "本地 HEAD = 1567581c26ec29f4216c6e6835415bf30343b0e3（2026-09-10 10:13:43 -0500）；GitHub API MIT / 25926 stars / pushed_at 2026-09-10T15:13:43Z；仓库根 LICENSE 为 MIT。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "0f0b2e01b6df48d1baca1e2a8a3964b49e5616ea830e86b2c676aa2ec141edf3",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-wechat-summary.tar.gz",
    "sha256": "0f0b2e01b6df48d1baca1e2a8a3964b49e5616ea830e86b2c676aa2ec141edf3",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-wechat-summary",
    "path": "skills/baoyu-wechat-summary",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}