{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "csv-data-summarizer",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "install_deps",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local script or command: python analyze.py [csv_path] (defaults to resources/sample.csv)"
    },
    {
      "file": "scripts/ 或 SKILL.md",
      "summary": "Declares dynamic installation of external language package dependencies"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: writes PNG files with fixed filenames to the **current working directory**: correlation_heatmap.png, time_series_analysis.png, dis"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 逐段回读 analyze.py 全文（182 行）核对报告结构与四类图条件，确认无隐藏网络/文件写入口（import 仅 pandas/matplotlib/seaborn/pathlib，写盘仅四处 plt.savefig 与 plt.close）；② 对数据列判据做**实测复现**：在 /tmp 建临时 venv 装 pandas 3.0.5，用与 analyze.py 逐字相同的表达式在仓库自带 examples/showcase_financial_pl_data.csv 上跑 date_cols 判定与后续 pd.to_datetime/区间计算，得到『误命中 customer_lifetime_value 且区间为 1970 epoch 纳秒差 8800ns、Span 0 days』的实测结果；③ 对『自适应/智能识别行业』这一主要宣传点做代码级证伪：全文件无任何行业/数据类型分类逻辑，只有 dtype 分支；④ 交叉核对文档三处描述与代码行为（日期列判据、可视化触发条件、文件清单），逐条记为发现出入；⑤ 校验分发包一致性：zip 内 analyze.py/SKILL.md/requirements.txt 的 sha256 与工作区同名文件逐一比对，全部一致；⑥ 元数据核对 gh api（465★ / license=null / pushed_at 2025-10-16T20:20:06Z）与本地 HEAD 9b3affd 一致。",
    "second_pass": [
      {
        "item": "『无网络外发/无凭证读取』结论",
        "status": "ok",
        "detail": "analyze.py imports 仅 pandas/matplotlib.pyplot/seaborn/pathlib；全仓（排除 .git）关键词扫描 requests|urllib|socket|http|subprocess|os.system|getenv|os.environ 零命中；URL 仅出现在 README/resources/README 的徽章与社区链接。"
      },
      {
        "item": "日期列判据与文档不符（实测）",
        "status": "discrepancy",
        "detail": "SKILL.md Notes 写 'Automatically detects date columns (columns containing \\'date\\' in name)'，实际代码是 \"'date' in c.lower() or 'time' in c.lower()\"。实测在仓库自带演示集上命中 **customer_lifetime_value**（'life**time**' 含 'time'），随后 pd.to_datetime 把 2400 一类整数按纳秒解释成 1970 年，输出 'Date range: 1970-01-01 … to 1970-01-01 …'、'Span: 0 days'，并据此画出无意义的时间序列图（实测 pandas 3.0.5；该行为与 pandas 2.x 一致：to_datetime(int) 亦按纳秒）。即 README 宣称该演示集『Perfect for showcasing time-series analysis』，实际触发的是误判列。"
      },
      {
        "item": "『自适应/智能识别行业数据类型』的能力声明",
        "status": "discrepancy",
        "detail": "SKILL.md 列出 Sales/E-commerce、Customer、Financial、Operational、Survey 五类数据的『相应分析』，README 写 'Automatically detects data type (sales, customer, financial, survey, etc.) and applies relevant analysis'；但 analyze.py 没有任何行业或语义分类代码，全部行为由 dtype 与列名子串决定（number→describe/corr/hist，object→value_counts/barh，含 date|time→区间）。属**能力夸大**：它确实会因列构成不同而产出不同报告，但没有『识别数据类型』这一步。"
      },
      {
        "item": "Notes『Generates visualizations only when date columns are present』",
        "status": "discrepancy",
        "detail": "实际仅 time_series_analysis.png 需要日期列；distributions.png 只需数值列、categorical_distributions.png 只需分类列、correlation_heatmap.png 只需 ≥2 数值列。该句把条件说得比实现更严，属文档描述偏差（本身不影响使用）。"
      },
      {
        "item": "SKILL.md『Files』清单与仓库实际文件",
        "status": "discrepancy",
        "detail": "SKILL.md 只列 analyze.py、requirements.txt、resources/sample.csv、resources/README.md；仓库另有 examples/showcase_financial_pl_data.csv（README 重点宣传的演示集）与 csv-data-summarizer.zip（分发包）。清单不完整。"
      },
      {
        "item": "分发包与源码一致性",
        "status": "ok",
        "detail": "zip 内 analyze.py（sha256 fa217db952541d59…）、SKILL.md（1599338ac2db52ba…）、requirements.txt（3787888dbf39eb94…）与工作区同名文件哈希完全相同；zip 结构为 SKILL.md/analyze.py/requirements.txt/resources/{sample.csv,README.md}。"
      },
      {
        "item": "依赖声明三重一致",
        "status": "ok",
        "detail": "SKILL.md frontmatter metadata（python>=3.8, pandas>=2.0.0, matplotlib>=3.7.0, seaborn>=0.12.0）与 requirements.txt 三行、README Technical Details 段逐项吻合；实际运行时三项库均被 import（seaborn 用于 heatmap，matplotlib 用于绘图）。"
      },
      {
        "item": "写盘行为与覆盖风险",
        "status": "ok",
        "detail": "四处 plt.savefig 全部使用相对文件名（correlation_heatmap.png / time_series_analysis.png / distributions.png / categorical_distributions.png）+ dpi=150 + plt.close()；不创建目录、不检查同名文件、不接受输出路径参数——已在 file_writes 与 risks 记入。"
      },
      {
        "item": "无用依赖/死代码检查",
        "status": "ok",
        "detail": "analyze.py 顶部 'from pathlib import Path' 全文件未被使用（minor）。不影响功能，未写入风险项。"
      },
      {
        "item": "license/stars/commit 元数据",
        "status": "ok",
        "detail": "gh api repos/coffeefuelbump/csv-data-summarizer-claude-skill：465★、pushed_at=2025-10-16T20:20:06Z、archived=false、license=null；仓库无 LICENSE 文件而 README 自述 MIT——已在 meta.license 如实标注冲突。本地 HEAD=9b3affd270f85aaf1c8a7a457f510034d5736cde，与任务书 pin 一致。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "9b3affd270f85aaf1c8a7a457f510034d5736cde",
    "sha256": "812ec659a4b533a87d97b00d203b399012794c81b9cf269264e21097cf4484ab",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/csv-data-summarizer.tar.gz",
    "sha256": "812ec659a4b533a87d97b00d203b399012794c81b9cf269264e21097cf4484ab",
    "commit": "9b3affd270f85aaf1c8a7a457f510034d5736cde"
  },
  "original": {
    "github": "https://github.com/coffeefuelbump/csv-data-summarizer-claude-skill",
    "path": "",
    "commit": "9b3affd270f85aaf1c8a7a457f510034d5736cde"
  }
}