{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "baoyu-youtube-transcript",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Invokes unofficial or reverse-engineered private APIs / spoofs client identifiers"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user login states and session cookies"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: process.env.YOUTUBE_TRANSCRIPT_COOKIES_FROM_BROWSER (the only env read in the entire skill) → used as yt-dlp parameter"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: ${BUN_X} {baseDir}/scripts/main.ts <url|id> (via bun, or npx -y bun; skill directory contains only TS)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: https://www.youtube.com/watch?v=<id>&hl=en&persist_hl=1&has_verified=1&bpct"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: youtube-transcript/ (default, configurable via --output-dir)"
    }
  ],
  "verification": {
    "method": "第一遍：本人通读 skills/baoyu-youtube-transcript/SKILL.md 全文（Options/缓存/错误码/说话人流程）并交叉核对 README 定位。第二遍：独立只读 scout 换角度重做取证——逐文件扫描 import/env/spawn/URL 常量、核对 yt-dlp 探测顺序与参数构造、核对 --translate 是否真有外部翻译调用、核对写盘清单与文档输出树是否一致；随后由构建脚本对每条 evidence.quote 在 pin 源码上做空白归一化逐字断言（定位不到即构建失败，不硬写）。",
    "second_pass": [
      {
        "item": "InnerTube 端点与 key 现场抓取（无硬编码 key）",
        "status": "ok",
        "detail": "youtube.ts 含 INNERTUBE_URL/WATCH_URL 常量与 html.match(/\"INNERTUBE_API_KEY\":...) 抓取逻辑；全仓无硬编码 API key，只有会随版本过期的客户端版本号与 UA 常量。"
      },
      {
        "item": "三套客户端身份轮换（ANDROID/WEB/IOS）+ 对应头",
        "status": "ok",
        "detail": "clientName \"ANDROID\"/\"WEB\"/\"IOS\"、X-YouTube-Client-Name / X-YouTube-Client-Version / X-Goog-Visitor-Id 头与 Pixel 8 Pro UA 均在源码中；与 SKILL.md 的『bot detected』说明一致。"
      },
      {
        "item": "yt-dlp 回退的探测与参数",
        "status": "ok",
        "detail": "三个候选命令（yt-dlp / uvx / python3 -m yt_dlp），--version 探测后还要 --help 命中 --js-runtimes 与 --remote-components；执行参数为 -J --skip-download --js-runtimes bun --remote-components ejs:github（可选 --cookies-from-browser）。"
      },
      {
        "item": "--translate 无任何外部翻译服务",
        "status": "ok",
        "detail": "只有 url += `&tlang=${translateTo}` 与 isTranslatable / translationLanguages 前置检查；无 Google Translate / LLM / HTTP 翻译调用，依赖面为零 npm 包。"
      },
      {
        "item": "零 npm 依赖、skill 内无 package.json",
        "status": "ok",
        "detail": "skill 目录仅 .ts 与 prompt 模板；全部 import 为 node 内置（fs/path/child_process/node:test/node:assert）与相对 .ts；根 package.json 的 workspaces 只覆盖 packages/*。"
      },
      {
        "item": "全 skill 唯一 env 读取 = YOUTUBE_TRANSCRIPT_COOKIES_FROM_BROWSER",
        "status": "ok",
        "detail": "跨目录 grep process.env / env[ / YOUTUBE_ 仅命中该变量（读取一处、拼参数一处）；未设置时回退路径不带 cookie，故凭证面为『闸门 + 委派』而非默认开启。"
      },
      {
        "item": "写盘清单与 SKILL.md 输出树一致",
        "status": "ok",
        "detail": "代码写入 .index.json / meta.json / transcript-raw.json / transcript-sentences.json / imgs/cover.jpg / transcript.md|.srt，与 SKILL.md 目录树逐项对齐；不落盘任何 token。"
      },
      {
        "item": "文档与代码的次要出入",
        "status": "ok",
        "detail": "SKILL.md 工作流小节出现两个编号为 3 的步骤（文档笔误，不影响结论）；--speakers 隐含 --chapters 的说明与代码分支一致。"
      },
      {
        "item": "测试是否触碰真实网络",
        "status": "ok",
        "detail": "main.test.ts 使用注入的 stub fetcher 与 example.com 形式的假 URL，无真实网络、无写盘。"
      },
      {
        "item": "档位复核（能力级范式）",
        "status": "ok",
        "detail": "按批4 终裁与站内先例（scrapling-skill 需显式旗标仍判红、notebooklm-skill 默认路径免登录仍判红），本条命中『逆向/伪装 + 凭证委派 + 自举第三方 CLI』，判 red 而非 orange；‘env 未设时免登录’作为程度说明写在 reason，不降档。"
      },
      {
        "item": "元数据（license / stars / pushed_at）与 pin",
        "status": "ok",
        "detail": "本地 HEAD = 1567581c26ec29f4216c6e6835415bf30343b0e3（2026-09-10 10:13:43 -0500）；GitHub API：MIT、stargazers 25926、pushed_at 2026-09-10T15:13:43Z；仓库根 LICENSE 为 MIT（Copyright (c) 2026 Jim Liu）。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3",
    "sha256": "dbf11afd644a496318b001d94cef7f894be94562951f150228a53c30a3780c86",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/baoyu-youtube-transcript.tar.gz",
    "sha256": "dbf11afd644a496318b001d94cef7f894be94562951f150228a53c30a3780c86",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  },
  "original": {
    "github": "https://github.com/JimLiu/baoyu-skills/tree/main/skills/baoyu-youtube-transcript",
    "path": "skills/baoyu-youtube-transcript",
    "commit": "1567581c26ec29f4216c6e6835415bf30343b0e3"
  }
}