{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "codex-image-to-eagle",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local script or command: node scripts/archive-codex-image-to-eagle.js (bundled script triggered by agent via Bash(node *))"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: Local loopback only: HTTP POST http://127.0.0.1:41596/api/tools/call (can be overridden by EAGLE_SERVER_URL)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Local only: creates/deletes <hash>.lock directories under os.tmpdir() to serialize folder creation; does not write images or modify source files"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 对 822 行脚本做逐类 token 扫描（http/spawn/exec/readFileSync/writeFileSync/process.env/homedir/config.toml/lock），确认调用点真实存在并定位到行；② 全仓 grep 'https?://' 确认除 README 营销链接外，唯一网络端点就是 127.0.0.1:41596 回环，无遥测/CDN；③ 反向核对 SKILL.md 声称的文件夹安全规则是否在代码里兑现（findFolderByNameAndParent 按 name+parentId 过滤、sort by createdAt）；④ 核对 SKILL.md 与 README 对默认端的描述差异（127.0.0.1 vs localhost，同端口，已分别取证）；⑤ 夸大检查：README 自述「未建议随意反复测试实际写入」，与 SKILL 的『不要删源文件』『先 --dry-run』一致，无过度承诺。",
    "second_pass": [
      {
        "item": "每条外部依赖的反查",
        "status": "ok",
        "detail": "Node 依赖：脚本 require 仅 fs/path/http/os/child_process，无 node_modules、无 package.json；Eagle 回环端点：DEFAULT_SERVER 常量 + callTool() 的 http.request 两处互证；stdio 子进程：spawn 调用点 + README 的 mcp-proxy.js 示例互证。"
      },
      {
        "item": "是否有被遗漏的网络调用",
        "status": "ok",
        "detail": "全文件仅 import http 一处，唯一 http.request 出现在 httpRequest()，被 callTool() 以 DEFAULT_SERVER 构造的 hostname/port 使用；无 fetch/https/axios/WebSocket。"
      },
      {
        "item": "凭证读取结论的反例搜索",
        "status": "ok",
        "detail": "process.env 命中集中在配置项（图片目录/服务地址/文件夹 ID/MCP 参数/锁超时），未见读取密钥文件、keychain、.env 或打印敏感值；但 spawn 透传全量 env 确认成立，故归入橙档依据之一。"
      },
      {
        "item": "文件夹安全规则 vs 代码实现",
        "status": "ok",
        "detail": "SKILL 第 1–5 条规则均可在代码定位：fixedFolderId 短路、folder_get(getAllHierarchy/fullDetails)、findFolderByNameAndParent(name+parentId)、folder_create(parentId)、复用最旧（按 createdAt 升序取 matches[0]）。"
      },
      {
        "item": "默认服务地址描述一致性",
        "status": "ok",
        "detail": "SKILL.md/脚本为 127.0.0.1:41596 并说明优先 IPv4 回环的原因；README 写 localhost:41596。二者同端口不同写法，已分别作为独立条目取证，不视为出入。"
      },
      {
        "item": "功能声明与实现相符度",
        "status": "ok",
        "detail": "description 承诺的 save/archive/import/sync + prompt/tags/folders 全部有对应实现（item_add 载荷含 tags/items、annotation、folders）；『不泛化为任意素材库迁移』与代码仅面向 Eagle 相符。"
      },
      {
        "item": "dry-run 是否真的不写库",
        "status": "ok",
        "detail": "resolveFolderPath() 在 dryRun 时直接返回伪造的 folder-path 字符串，main() 在 dryRun 分支提前 return，未调用 item_add —— 预览路径无写入，结论成立。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "fcee81beb62a0907b206e62b269195dbd9aac4c3",
    "sha256": "5914cacc5fbf46dc8ec7aef107ff522369dbbb0e9c7e67fb2ae87b3f860c15a8",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/codex-image-to-eagle.tar.gz",
    "sha256": "5914cacc5fbf46dc8ec7aef107ff522369dbbb0e9c7e67fb2ae87b3f860c15a8",
    "commit": "fcee81beb62a0907b206e62b269195dbd9aac4c3"
  },
  "original": {
    "github": "https://github.com/vibeshotclub/vsc-skills/tree/main/codex-image-to-eagle",
    "path": "codex-image-to-eagle",
    "commit": "fcee81beb62a0907b206e62b269195dbd9aac4c3"
  }
}