{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "embedded-captions",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script/command execution: bash scripts/prepare.sh <project> (spawns node matte.cjs / transcribe.cjs / aud in parallel)"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: uvx fetches whisperx==3.8.6 and dependencies on demand from PyPI (pinned version to prevent 'latest' non-reproducibility)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: <project>/frames_fg/, frames_bg/, matte.fps, audio.mp3, _wx_audio.wav, _wx_out/ ("
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 全量文件清单（含隐藏）核对：142 个文件（唯一隐藏文件是 .gitignore），与 skills-manifest.json 的 files=142 一致；构成 = 25 md + 38 json + 18 cjs + 2 mjs + 3 sh + 1 py + 7 html + 44 woff2 + 2 svg + 1 css + 1 无扩展名。② token 扫描（URL / fetch / process.env / child_process / writeFile / API_KEY|TOKEN|SECRET|.env|Bearer|keychain / eval|new Function）：网络关键词命中全部落在 3 类可解释来源——模板/示例 HTML 的 gsap CDN、Hershey SVG 的 W3C XML 命名空间与 thingiverse 出处链接、make-theme.cjs 的 SVG 命名空间常量；eval/new Function 0 命中（唯一 'exec' 是正则 .exec）；凭证关键词 0 命中（.heygen / api_key / keychain 全部无）。③ 关键脚本逐行打开验证调用点：transcribe.cjs 读到 whisperxSpec 与 uvx 参数、matte.cjs 读到 spawnSync(hfCli(), 'remove-background') 与 ~168MB 缓存路径注释、prepare.sh 读到三路并行与 safe-zones 串联、render-and-composite.sh 读到 FPS 权威来源/长度钳制/Bug-1 guard/rail 与 embed 两条合成路径。④ 数字类声明实测：CATALOG.md 身份行 35 条、dna/*.json 10 个、themes/*.json 25 个、references/*.md 14 篇——与 SKILL.md 自述的『35 identities（10 classic + 25 themed）』完全吻合，无夸大。⑤ 功能声明 vs 实际能力：description 说 'runs locally end to end, including transcription and subject matting'——实测转录为本地 WhisperX（uvx 拉包但本地推理）、抠像为本地 ONNX CPU 推理，成立；未见越界承诺。⑥ 组内一致性：与同批 product-launch-video/faceless-explainer 对比，本 skill 不读 ~/.heygen（0 命中），确认其『全本地』定位属实。",
    "second_pass": [
      {
        "item": "是否隐藏凭证读取（与同批 HeyGen 系 skill 的差异）",
        "status": "ok",
        "detail": "对整目录 grep `\\.heygen|HEYGEN|api[_-]?key|TOKEN|SECRET|keychain|Bearer|Authorization` → 0 命中；process.env 命中 12 处全部是 HYPERFRAMES_ROOT / WHISPER_MODEL / WHISPER_LANG / TRANSCRIBE_ENGINE / WHISPERX_VERSION 等行为开关。『全本地、无凭证』成立。"
      },
      {
        "item": "网络外发是否全部可预期",
        "status": "ok",
        "detail": "逐条回查：uvx 拉 whisperx（版本钉死 3.8.6，注释明说是为防供应链与不可复现）；模型下载由 hyperframes CLI 自管且路径固定在 ~/.cache/hyperframes/；CDN 引用仅在 engine.html / example-renders / _archive 模板内；无其它域名。未发现隐藏上报或遥测。"
      },
      {
        "item": "实现原理与功能声明是否相符",
        "status": "ok",
        "detail": "'runs locally end to end, including transcription and subject matting' 成立（本地 WhisperX + 本地 ONNX 抠像）；'without editing the footage' 成立（Standard/Cinematic 只叠加，脚本注释与 SKILL.md 均强调不调色/不覆盖）；唯一被允许改原片的是 Theme 的 PLATE 反应预算，SKILL.md 已显式标注为例外。"
      },
      {
        "item": "SKILL.md 的三引擎描述与脚本实际状态不一致（文档漂移）",
        "status": "discrepancy",
        "detail": "SKILL.md 开篇仍把 Standard 描述为默认模式（'**Standard** (default) builds a clean verbatim **rail** … + an **embed** climax'），并在多处按 rail.html + index.html 描述两轨产出；但同 commit 的 scripts/render-and-composite.sh 第 35-37 行写着 'Standard mode retired 2026-06-12 — rail-surface needs are served by theme DNAs like \"anchor\"'，dna/README.md 第 15-16 行同样写 'Standard/rail mode was retired 2026-06-12'，make-composition.cjs 第 253-257 行则在检测到 standard 派生的 plan.json 时直接报错退出。然而 scripts/ 下仍保留完整的 STANDARD 合成分支（第 392 行起 'STANDARD mode (rail + embed) — detected by rail.html'）、modes/standard/ 目录与 44 个字体仍在包内。结论：**rail + peak embed 的实现仍在，但文档层（SKILL.md）已落后于引擎层（dna/README、render 脚本注释）**，两处关于『默认模式』的说法互相矛盾。这是对 pin commit 有效的真实出入，非第一遍误读。"
      },
      {
        "item": "『35 身份』等数量声明的准确性",
        "status": "ok",
        "detail": "实测 CATALOG.md 身份行 = 35；dna/*.json = 10（chrome/cream/documentary/editorial/glitch/ink/keynote/loud/neon/velocity）；themes/*.json = 25；references/*.md = 14。与 SKILL.md 自述一致。"
      },
      {
        "item": "门禁是否真的会执行（而非只写在文档里）",
        "status": "ok",
        "detail": "render-and-composite.sh 内确实依次调用 check-timing（plan+transcript 存在时）、measure-layout + check-occlusion（plan + frames_fg 存在时）、check-overflow（无 plan 的 custom 模式告警）、check-rail-climax（rail.html 存在时，支持 RAIL_CLIMAX_SKIP=1 覆盖），并把结果汇总进 _gates.txt；与 SKILL.md 的门禁描述对应。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "b8328f957368713d288900957eb5bee0dca31dd9",
    "sha256": "9cdab9186d817c1299b372d83f947650799e88a063160483aaa7c30ecf619663",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/embedded-captions.tar.gz",
    "sha256": "9cdab9186d817c1299b372d83f947650799e88a063160483aaa7c30ecf619663",
    "commit": "b8328f957368713d288900957eb5bee0dca31dd9"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes/tree/main/skills/embedded-captions",
    "path": "skills/embedded-captions",
    "commit": "b8328f957368713d288900957eb5bee0dca31dd9"
  }
}