{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "duo",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: node scripts/build.mjs --out <dir> [--id …] [--duration 10] [--icons tiktok"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: registry.npmjs.org: HyperFrames CLI fetched via npx (SKILL.md notes mutable @latest, recommending version pinning)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: build.mjs writes strictly within --out: index.html, hyperframes.json, assets/{plate.png,screen-s"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全量文件清单核对（11 个文件：SKILL.md + scripts/build.mjs + template/index.template.html + assets/{plate.png,plate-preview.jpg,screen-spec.json,icons-tiktok.svg,icons-instagram.svg} + references/{screen-geometry.md,feed-recipes.md,sourcing-real-ui.md}）。② build.mjs 的 import 行逐条核对（仅 node:fs / node:path / node:url，无网络模块）。③ URL 扫描：唯一执行期端点是 registry.npmjs.org 与 cdn.jsdelivr.net；另命中 x.com/pbs.twimg.com（仅出现在 screen-spec.json 的来源留档字段）。④ process.env/os.environ 扫描：零命中。⑤ 交叉核对模板与 spec 的几何常量，并用 grep 确认 feed-recipes 引用的 #ig-like-filled 确实随包。⑥ 反例检查：专门找有没有隐藏的抓取脚本或凭证读取（结论：没有脚本，抓取只存在于文档指引里）。",
    "second_pass": [
      {
        "item": "build.mjs 是否真的无网络、无第三方依赖",
        "status": "ok",
        "detail": "import 仅 { promises as fs } from 'node:fs'、path、fileURLToPath；无 fetch/http/https/dns/child_process。全部行为是读模板、字符串替换 __COMPOSITION_ID__/__DURATION__、写文件与拷贝资源。头注释亦声明 '// No network access. No dependencies beyond Node 18+.'"
      },
      {
        "item": "『不改 rig』是否只是文案（模板与 spec 是否一致）",
        "status": "ok",
        "detail": "模板 #screen-left{left:223px;width:495px} / #screen-right{left:724px;width:498px}、.screen{top:105px;height:849px}、圆角 56px 12px 与 screen-spec.json 的 rect/outer_corner_radius_px/hinge_corner_radius_px 完全对应；build.mjs 也把可用视口打印成 '495x849' / '498x849'。"
      },
      {
        "item": "feed-recipes.md 引用的图标 symbol 是否随包（避免抄了配方却没有图标）",
        "status": "ok",
        "detail": "grep 确认 assets/icons-instagram.svg 内含 id=\"ig-like-filled\"（配方里 tl.set('#ig-heart-use', { attr: { href: '#ig-like-filled' } }, 2.7) 用到），另有 ig-like/ig-comment/ig-share/ig-home/ig-reels/ig-search/ig-camera/ig-verified 等 10 个 symbol；icons-tiktok.svg 含 tt-like/tt-comment/tt-bookmark/tt-share/tt-plus/tt-home/tt-discover/tt-inbox/tt-profile/tt-search/tt-add/tt-live/tt-verified/tt-note 共 14 个。"
      },
      {
        "item": "SKILL.md 的『Network and side effects (complete list)』是否真的完整",
        "status": "discrepancy",
        "detail": "该清单只列 registry.npmjs.org 与 cdn.jsdelivr.net，把抓取归入『Anything YOU add to the screens … is your side effect』；但同目录的 references/sourcing-real-ui.md 给出了具体抓取路径（www.tiktok.com、instagram.com、scontent-*.cdninstagram.com）与 UA/Referer 做法，并附 ffmpeg 裁片命令。对只读 SKILL.md 的用户而言，执行期外发面被低估了（文档级出入，非代码行为不符）。"
      },
      {
        "item": "『几何是从照片逐像素量出来的』能否在包内独立复核",
        "status": "unlocatable",
        "detail": "screen-spec.json 给出了量测结论（左右 rect、r=56/12、铰链 x719–723）与出处推文，但两个屏幕已被抹平、原始推文照片不在包内，且本次为只读侦查不联网取原图，故这些数值无法独立复算；references/screen-geometry.md 提供的是重测方法而非原始数据。"
      },
      {
        "item": "状态栏与铰链的还原是否有据可依",
        "status": "ok",
        "detail": "screen-spec.json 的 hinge 字段（x 719 / w 5 / rgb(130,133,142)）与 status_bar（左 9:41@x44,y18；右 wifi_battery_right_inset 40）给出像素级依据；feed-recipes.md 的忠实度清单要求复现该分置，SKILL.md 亦在 Flow 第 3 步复述。"
      },
      {
        "item": "底图与预览图的引用是否都在包内",
        "status": "ok",
        "detail": "SKILL.md 正文 ![plate](assets/plate-preview.jpg) 与 build.mjs 拷贝的 assets/plate.png、assets/screen-spec.json 均在包内；plate-preview.jpg 仅作预览，不参与渲染。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb",
    "sha256": "d33100badc2a58ee7a2f38b485563808fb56cd074c035edb296f08ae99f2d763",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/duo.tar.gz",
    "sha256": "d33100badc2a58ee7a2f38b485563808fb56cd074c035edb296f08ae99f2d763",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes-community-skills/tree/main/skills/duo",
    "path": "skills/duo",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  }
}