{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "excalidraw-use",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: excalidraw-use/scripts/build_scene.py (python3, pure standard library)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: http://127.0.0.1:8080 (local static server for headless browser loading of /tmp/deck-dist; python3 -m http.server)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: <out>.excalidraw (generated by build_scene.py, containing base64 embedded images; automatically creates parent directory)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① glob 全量文件清单核对资产面（SKILL.md + scripts×4 + references×3，共 8 个文件，无隐藏脚本、无数据文件）；② 全目录 token 扫描（https?://、curl、wget、fetch(、API_KEY、TOKEN、SECRET、.env、cookie、keychain、credential、process.env、os.environ、subprocess、child_process、exec(、spawn）——命中项逐条归类：excalidraw.com 出现在两处 source 字段与一处文档链接（非调用点），127.0.0.1:8080 是本地取页地址，shoot_deck.mjs 的 .exec( 命中的是正则 matchAll 的 RegExp.exec 而非进程执行——这条差异被专门记录，避免把正则 exec 误报成命令执行；③ 逐个脚本确认写盘路径与校验逻辑：build_scene.py 与 split_scene.py 均在写后 read-back（含 sha1 与内容比对），inspect_scene.py 全文无写操作；④ 功能声明 vs 实际能力：description 宣告三件事（摆图到白板 / 先把 deck 变成图 / 检视 .excalidraw），分别由 Job1/Job2/Job3 三脚本兑现，且 SKILL.md 主动声明不做「从文字生成图表」，无夸大；⑤ 反例检索安全结论：查有无被漏掉的网络调用或删除动作——无 requests/urllib/axios，无 unlink/rmtree/os.remove，唯一的文件删除是 package 类脚本之外不存在；⑥ 元数据交叉核对同 repo 同 commit 的池内既有值。",
    "second_pass": [
      {
        "item": "external_deps 每条的调用点是否真实存在",
        "status": "ok",
        "detail": "puppeteer（shoot_deck.mjs 第 1 行 import）、node（shebang）、npx vite build 与 python3 -m http.server（SKILL.md Job 2 命令行）、127.0.0.1:8080（--url 实参）全部实读命中，非推测。"
      },
      {
        "item": "excalidraw.com 是否被当作网络端点误报",
        "status": "discrepancy",
        "detail": "〔第二遍标注：第一遍易误报，已修正〕build_scene.py 与 split_scene.py 里的 https://excalidraw.com 只是写入 scene 的 \"source\" 字段值，脚本从不请求该域名；README/文档里的链接同理。已在 external_deps 中显式标注『不是调用点』，避免把字符串常量当成外发。"
      },
      {
        "item": "exec( 命中是否意味着命令执行",
        "status": "discrepancy",
        "detail": "〔第二遍标注：扫描器误报，已澄清〕shoot_deck.mjs 的 const frag = /fragmentCount:\\s*(\\d+)/.exec(m[2]) 是 JavaScript RegExp.prototype.exec，属正则匹配，不执行进程。全目录无 child_process / spawn / execSync / subprocess。"
      },
      {
        "item": "『不写用户现场板子』是否只是口号",
        "status": "ok",
        "detail": "代码层：build_scene.py 只写 --out 指定路径，从不读入并回写用户的板子文件；文档层：SKILL.md 有独立小节『## Never write into their live board file』并给出两条独立理由（标签页不监听文件、磁盘文件通常旧于浏览器状态）。"
      },
      {
        "item": "写入后校验是否真做（不是文档承诺）",
        "status": "ok",
        "detail": "build_scene.py 的 verify() 在 build() 末尾被调用且从磁盘重读；split_scene.py 对每个分片做同样校验。两道都是可执行代码，失败即 SystemExit。"
      },
      {
        "item": "python3 -m http.server 绑定范围",
        "status": "unlocatable",
        "detail": "〔第二遍标注：文档未声明，属解释器默认行为〕SKILL.md 只写 python3 -m http.server 8080，未写 --bind 127.0.0.1；http.server 的默认绑定是 0.0.0.0。这是 CPython 的既定行为而非本 skill 的代码，故标注为「文档未声明」并在 security.reason 中提示，不写成 skill 缺陷。"
      },
      {
        "item": "Job 2 的 --advance 互斥是否代码强制",
        "status": "ok",
        "detail": "shoot_deck.mjs 中 if (!['pdf','keys'].includes(ADVANCE)) 报错退出，且 query 只在 ADVANCE === 'pdf' 时拼 ?pdf=1；SKILL.md 有对应警告段，代码与文档一致。"
      },
      {
        "item": "元数据（license/stars/last_push）",
        "status": "ok",
        "detail": "取自同 repo 同 commit 的池内既有值（MIT、1385★、2026-09-09T12:33:29Z）；本次未联网复核 gh。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "0c4ae44eb4c051d396f764fc9af869c186ba1cbd0956da1f4c6d6a58ff820406",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/excalidraw-use.tar.gz",
    "sha256": "0c4ae44eb4c051d396f764fc9af869c186ba1cbd0956da1f4c6d6a58ff820406",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/excalidraw-use",
    "path": "excalidraw-use",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}