{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "dbs-video-extract",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "credential",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reads user login cookies/sessions/keyrings: macOS Keychain services dbs-tikhub-api-key / dbs-qingdou-api-key (security find-generic-"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: python3 scripts/extract_video.py --check-keys / --mode both|data|transcript"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: TikHub: https://api.tikhub.dev / https://api.tikhub.io (REST)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: {output_dir}/{author}/{title}.md (transcript archiving; skips existing files by default, overwrites only with --overwrite)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 资产面：find 确认 9 个文件（SKILL.md、agents/openai.yaml、3 references、4 scripts），逐个实读；② 端點穷举：对 scripts/*.py 与 references/*.md 做 URL 正则全量抽取，得到 api.tikhub.dev / api.tikhub.io / mcp.tikhub.io×3 / www.qingdou.vip / user.tikhub.io 及文档与 Swagger 链接，逐一归档（文档链接不计入运行时依赖）；③ 凭证路径穷举：grep os.environ / Path.home / security / keychain / getpass，确认四级来源与 0600 写入；④ 网络与写盘穷举：grep urllib/subprocess/write_text/mkdir/chmod，确认无第三方 HTTP 库、写盘仅两处；⑤ 反例寻找：专查\"是否有隐蔽外发/遥测\"——除上述两个服务与购买页字符串外无其它域名或上报逻辑；⑥ 反爬/绕过核查：全文无 UA 伪造、无代理池、无风控绕过指令，SKILL.md 反而写明\"不尝试绕过\"；⑦ 分级依据：目录内脚本读凭证 + 调第三方 API（可能计费、素材出网）→ 🟠。",
    "second_pass": [
      {
        "item": "凭证四级来源与钥匙串调用真实存在",
        "status": "ok",
        "detail": "tikhub_api.py / extract_video_transcript.py 中 find_api_key 依次读 env → 指定文件 → ~/.config/dbs/API_Keys.md → subprocess security；KEYCHAIN_SERVICE 分别为 dbs-tikhub-api-key、dbs-qingdou-api-key。"
      },
      {
        "item": "凭证写入按安全实践（0600 + 原子替换）",
        "status": "ok",
        "detail": "configure_api_key.py：mkstemp → write → temporary.chmod(0o600) → os.replace → target.chmod(0o600)，异常时 unlink 临时文件。"
      },
      {
        "item": "错误信息脱敏（不泄漏 Key）",
        "status": "ok",
        "detail": "两个客户端均含 detail.replace(api_key, \"[REDACTED]\")，且响应体截断（500/1000 字符）。"
      },
      {
        "item": "外部端點清单无遗漏",
        "status": "ok",
        "detail": "全量 URL 抽取得到的运行时端點仅 TikHub（REST/MCP）与轻抖；其余为文档/购买页链接。"
      },
      {
        "item": "无第三方 Python 包依赖",
        "status": "ok",
        "detail": "脚本 import 仅 json/logging/os/re/subprocess/sys/time/urllib/datetime/pathlib/typing/argparse/tempfile/getpass；目录内无 requirements.txt/setup.py/pyproject.toml。"
      },
      {
        "item": "不绕过平台限制、不自动下载/发布",
        "status": "ok",
        "detail": "SKILL.md 原文\"公开、删除、私密、版权和可见范围限制以接口返回为准，不尝试绕过。\"与\"不自动下载媒体、发布内容、提交 Git 或推送。\""
      },
      {
        "item": "\"已存在默认跳过\"的写盘保护属实",
        "status": "ok",
        "detail": "extract_video_transcript.py save_item 依据 overwrite 参数决定是否跳过；SKILL.md 与 agents/openai.yaml 表述一致。"
      },
      {
        "item": "付费与法律提示为强制展示",
        "status": "ok",
        "detail": "SKILL.md\"必须先原样展示下面这条提示，不能省略或改写\"，法律提示文本与脚本 LEGAL_NOTICE 常量同源。"
      },
      {
        "item": "第三方返回内容原样落盘的注入面",
        "status": "ok",
        "detail": "SKILL.md\"正文忠实保存 API 返回内容，不补写、润色或修订口误\"→ 该文本会写进 Markdown；已如实记入 injection_surface，不视为脚本漏洞。"
      },
      {
        "item": "轻抖接口的完整参数与限额细节",
        "status": "unlocatable",
        "detail": "references/qingdou-api.md 给出端點与 batchStatus 语义，但服务端的配额、频控与计费明细不在本仓库源码内，无法定位。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314",
    "sha256": "3d8bb7e6cc40716a11c12ce40fcd357efb4f9b61435916f1182b76761f1202b3",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/dbs-video-extract.tar.gz",
    "sha256": "3d8bb7e6cc40716a11c12ce40fcd357efb4f9b61435916f1182b76761f1202b3",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  },
  "original": {
    "github": "https://github.com/dontbesilent2025/dbskill/tree/main/skills/dbs-video-extract",
    "path": "skills/dbs-video-extract",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  }
}