{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "caveman-compress",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local script or command: python3 -m scripts <absolute_filepath> (the sole execution mechanism specified in SKILL.md)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: Anthropic API via anthropic SDK (client.messages.create), active when ANTHROPIC_API_KEY is present"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: modifies the target file directly (in-place overwrite with compressed content)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（重点找第一遍可能夸大或漏掉的网络/写盘点）：① 全文逐类 token 扫描 compress.py/cli.py/detect.py/validate.py/benchmark.py/__main__.py：http(s)://、urllib、requests、socket、curl、wget、os.system、shell=True、eval、exec、open( 写模式、os.remove、shutil.rmtree、keychain —— 结果：网络 token 仅出现在 anthropic SDK 与 subprocess 调用处，无 urllib/requests，无 shell=True，无 eval/exec，无 keychain（凭证只经环境变量）；② 对每个 external_deps 条目回源码确认调用点（SDK 分支 / subprocess 分支 / tiktoken import 均已逐行读到）；③ 写盘点枚举所有写路径（目标文件、备份、锁、暂存、失败回滚 unlink），确认无其他写入；④ 反例搜索：是否存在「校验通过但内容被改坏」的路径——找到 validate.py 的缩进代码块检测与 inline code 配对注释（#820）说明作者已识别「false PASS 比 false FAIL 更危险」，并以 fail-closed 处理；⑤ 功能声明 vs 实际能力：SKILL.md 的 'Saves ~46% input tokens' 与 README 基准表平均值 46% 一致，'retry up to 2 times' 与 MAX_RETRIES = 2 一致；⑥ 路径与镜像核对：skills/caveman-compress 与 plugins/caveman/skills/caveman-compress 的 SKILL.md+scripts 用 diff -r 比对为逐字节相同；⑦ 本地 HEAD == origin/main == 15581d14007fd01fb3f132016741962f34936ca2。",
    "second_pass": [
      {
        "item": "SKILL.md 提到的脚本路径与运行方式",
        "status": "ok",
        "detail": "`python3 -m scripts <file>` 成立：scripts/__main__.py 导入 cli.main 并调用；cli.py 校验参数个数与文件存在/类型后执行 compress_file。SKILL.md 提示的 'search for scripts/__main__.py' 与实际文件名一致。"
      },
      {
        "item": "Anthropic 为唯一网络出口",
        "status": "ok",
        "detail": "六个脚本中无 urllib/requests/socket/curl/wget 命中；网络仅经 anthropic SDK client.messages.create 或 claude CLI 子进程。SDK 端点在源码中未硬编码，故 external_deps.endpoint 留空（不臆测）。"
      },
      {
        "item": "「subprocess 无 shell 注入」这一说法",
        "status": "ok",
        "detail": "subprocess.run([claude_bin, \"--print\", \"--setting-sources\", \"\", \"--strict-mcp-config\"], input=prompt, ...) 为列表参数 + stdin，无 shell=True；SECURITY.md 亦声明 'Does not use shell=True or string interpolation in subprocess calls'。"
      },
      {
        "item": "「备份在源目录之外」是否属实（SKILL.md / Purpose 段）",
        "status": "ok",
        "detail": "backup_dir_for() 返回 _state_base_dir(\"backups\")/filepath.parent.name，其中 _state_base_dir 为 $XDG_DATA_HOME/caveman-compress 或 ~/.local/share/caveman-compress（Windows 用 %LOCALAPPDATA%），确实不在源文件旁；注释给出理由（skill auto-loader 会二次读入 .original.md）。"
      },
      {
        "item": "敏感文件拒绝覆盖面的自评（第一遍称「覆盖 .env/credentials/密钥」）",
        "status": "ok",
        "detail": "逐条核对 SENSITIVE_BASENAME_REGEX 与 SENSITIVE_PATH_COMPONENTS/SENSITIVE_NAME_TOKENS：.env*、.netrc、credentials*、secret(s)*、password(s)*、id_rsa/dsa/ecdsa/ed25519(.pub)、authorized_keys、known_hosts、*.pem|key|p12|pfx|crt|cer|jks|keystore|asc|gpg；路径组件含 .ssh/.aws/.gnupg/.kube/.docker 与 credential(s)/secret(s)；名字 token 含 secret/credential/password/passwd/apikey/accesskey/token/privatekey。属启发式 denylist（可被改名绕过），已在 analysis 注记，未夸大。"
      },
      {
        "item": "固定大小上限 500KB",
        "status": "ok",
        "detail": "compress_file 内 MAX_FILE_SIZE = 500_000 且在任何 API 调用之前检查；SECURITY.md 亦声明 'Files larger than 500KB are rejected before any API call is made'。"
      },
      {
        "item": "「校验不过则原文件不动」",
        "status": "ok",
        "detail": "压缩候选先写 <file>.caveman-staged 并对其跑 validate；只有 is_valid 才 _write_target(filepath, ...)，两次重试用尽后 unlink 暂存与备份并打印 'Failed after retries: original left untouched'。"
      },
      {
        "item": "SKILL.md 压缩规则 vs 脚本提示词是否一致（有无文档吹牛）",
        "status": "ok",
        "detail": "SKILL.md 的 Remove/Preserve/Compress 规则与 build_compress_prompt 的 STRICT RULES 同向（保代码块、保行内代码、保 URL、保标题、保路径命令），脚本还把「不要给整体套一层 ```markdown 围栏」写进提示词，并有 strip_llm_wrapper 兜底剥离。无夸大。"
      },
      {
        "item": "镜像副本一致性",
        "status": "ok",
        "detail": "diff -r skills/caveman-compress plugins/caveman/skills/caveman-compress 输出仅 'Only in skills/caveman-compress: README.md / SECURITY.md'，SKILL.md 与 scripts/ 六个文件完全相同。"
      },
      {
        "item": "失败路径的锁与临时文件是否可能残留",
        "status": "ok",
        "detail": "file_lock 用 OS 原生锁（崩溃自动释放），锁文件本身保留在用户数据目录（属设计，注释说明避免手写 marker 的陈旧状态问题）；暂存文件在成功与失败两条路径上都 unlink；异常经由 _write_target 打印备份位置后 re-raise。未发现无界残留写入。"
      },
      {
        "item": "install 量与其他元数据",
        "status": "ok",
        "detail": "installs 1400 来自池内 skills.sh 计数（pool.json 中 installs=1400，source 'skills.sh-alltime,skills.sh-trending'，github_stars/license/last_push 为 null，故 stars 与 last_push 改用 gh api 实采）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "15581d14007fd01fb3f132016741962f34936ca2",
    "sha256": "52e12dda463f9c55dc8b6ca93cf50099c352c1bcf59a5fbd43960812c5ecd12c",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/caveman-compress.tar.gz",
    "sha256": "52e12dda463f9c55dc8b6ca93cf50099c352c1bcf59a5fbd43960812c5ecd12c",
    "commit": "15581d14007fd01fb3f132016741962f34936ca2"
  },
  "original": {
    "github": "https://github.com/juliusbrussee/caveman/tree/main/skills/caveman-compress",
    "path": "skills/caveman-compress",
    "commit": "15581d14007fd01fb3f132016741962f34936ca2"
  }
}