{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "canghe-danger-x-to-markdown",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "reverse_api",
    "terms_compliance",
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本",
      "summary": "Calls undisclosed or reverse-engineered private APIs / spoofs client identifiers"
    },
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Contains logic to bypass automation detection, disable host sandboxes, or skip SSL certificate validation"
    },
    {
      "file": "SKILL.md / 会话存储",
      "summary": "Reads or reuses browser user session cookies and login states"
    },
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: Account cookies: X_AUTH_TOKEN / X_CT0 (env prioritized), local cookies.json next, and finally via Chrome login retrieval (sk"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: scripts/main.ts (run via npx -y bun; spawns Chrome to read cookies during browser login fallback)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: https://x.com/home (login flow, X_LOGIN_URL in constants.ts)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: x-to-markdown/{username}/{tweet-id}.md (or path specified by -o)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 清单核对：bundle §1 的 16 个文件逐个对上，确认入口唯一、无混淆代码；② 端点重扫：SKILL.md 与 §3 URL 扫描对照，外发域名收敛为 x.com 与 pbs.twimg.com，无未记录域名；③ 凭据面穷举：核对 SKILL.md 的 X_AUTH_TOKEN/X_CT0 路径与 cookies.ts 的 spawn、paths.ts 的 env 覆盖键，逐条落到证据；④ 反查“是否更严重”：bundle §3「危險旗標/防護繞過」与「沙箱/未受控執行」均无命中，未见 TLS 降级、stealth 伪装、eval/远程代码；⑤ 功能声明核对：tweet/thread/article → markdown 与 YAML front matter 均有对应实现或文档证据。",
    "second_pass": [
      {
        "item": "逆向 API 而非官方 API（red 主因之一）",
        "status": "ok",
        "detail": "SKILL.md 有 DISCLAIMER「This tool uses a reverse-engineered X API, NOT official.」，并据此设 consent 门禁。"
      },
      {
        "item": "读取账号 cookie（red 主因之二）",
        "status": "ok",
        "detail": "SKILL.md 列出环境变量 X_AUTH_TOKEN/X_CT0 为首选来源、Chrome 登录为兜底；cookies.ts 内含 child_process spawn。"
      },
      {
        "item": "媒体下载范围受限",
        "status": "ok",
        "detail": "--download-media 为显式开关，ask 流程要求先出 markdown 再询问，非默认批量下载。"
      },
      {
        "item": "两道用户门禁",
        "status": "ok",
        "detail": "consent.json（accepted + disclaimerVersion）与 EXTEND.md 首次设置（BLOCKING，禁止静默默认）均在 SKILL.md 写明。"
      },
      {
        "item": "数据目录跨平台解析",
        "status": "ok",
        "detail": "paths.ts 按 win32/darwin/其他分派 APPDATA / Application Support / XDG_DATA_HOME，并支持 X_DATA_DIR 等覆盖。"
      },
      {
        "item": "GraphQL 与媒体模块内部实现",
        "status": "unlocatable",
        "detail": "graphql.ts / media-localizer.ts 正文未在证据包展开，仅依据 §1 文件清单与 §3 扫描行定位其存在与职责；未据此提升或降低档位。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c",
    "sha256": "f839fffff58e69c9f4032c334e34b07c0b44410ada105c62315dc7ca4caf430d",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/canghe-danger-x-to-markdown.tar.gz",
    "sha256": "f839fffff58e69c9f4032c334e34b07c0b44410ada105c62315dc7ca4caf430d",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  },
  "original": {
    "github": "https://github.com/freestylefly/canghe-skills/tree/main/skills/canghe-danger-x-to-markdown",
    "path": "skills/canghe-danger-x-to-markdown",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  }
}