{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "flux-kontext",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local scripts or commands: (Skill itself contains no scripts) Host agent executes out-of-repo CLI via Bash: `runcomfy run <vendor>/<model>/<endp"
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: POST https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-1-kontex"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: Generated artifacts are downloaded by the external CLI and written to `--output-dir` (documentation states aborts when single file > 2 GiB to prevent disk saturation)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：①`git ls-tree HEAD` + `ls -a` 核对 flux-kontext/ 内容面：仅 SKILL.md，无脚本/引用/模板/数据，仓库根无 .claude-plugin/marketplace 类清单；②对 SKILL.md 逐类 token 扫描（curl/wget/sudo/chmod/rm -/eval/base64/API_KEY/secret/password/source/.sh/python/os.system），命中项全部是文档链接与正文英文单词，无危险调用；③bash 代码块全量抽取（awk 提取 fence 内容）复核：只有 `npx skills add ...` 与 `runcomfy run ...` 两类命令 + JSON 示例，无其他可执行命令；④对 5 份 SKILL.md 逐段 diff 定位家族共享段落（Prerequisites / Security & Privacy 逐字 SAME，Exit codes 仅表头与 utm 不同）；⑤跨文件核对：被路由点名的 nano-banana-edit / gpt-image-2 / flux-2-klein 目录确认存在；⑥GitHub API 复核 pin：本地 HEAD = origin/main = fca19ae084c2，`gh api .../commits/fca19ae...` 返回 2026-05-15T10:59:49Z，pushed_at 2026-05-15T10:59:51Z，stars 48，license MIT；⑦功能声明 vs 实际能力夸大检查：description 承诺的四项（提示法捆绑、schema 文档、路由建议、CLI 调用）在正文逐项存在，未越界承诺本地算力或自托管推理。",
    "second_pass": [
      {
        "item": "skill 目录内容 = 仅 SKILL.md（无脚本/引用/模板）",
        "status": "ok",
        "detail": "git ls-tree HEAD 与 ls -a 双向核实：flux-kontext/ 下仅 SKILL.md；仓库根为 LICENSE + README.md + 31 个技能目录，无 plugins/、.claude/、scripts/。"
      },
      {
        "item": "外部依赖条目逐个回查调用点",
        "status": "ok",
        "detail": "runcomfy CLI 调用点 2 处（How to invoke 两个示例）、npm 安装 1 处（Prerequisites）、npx skills 1 处（安装行）、model-api 端点 1 处（How it works）、白名单与第三方 URL 抓取各 1 处（Security & Privacy）、文档/模型页/GitHub/skills.sh 链接多处——均实读命中。"
      },
      {
        "item": "Security & Privacy 的技术断言可在本仓证实",
        "status": "unlocatable",
        "detail": "token.json 权限 0600、2 GiB 下载上限、CLI 不做 shell 展开、下载白名单、退出码语义，描述的都是仓外 @runcomfy/cli 的行为；仓库内既无 CLI 源码也无版本 pin 引用，只能作为文档自述引用，不能坐实。同仓 runcomfy-cli/SKILL.md 有同一套自述，属同源转述而非独立证据。"
      },
      {
        "item": "安装一行与 GitHub 链接指向旧仓 agentspace-so/runcomfy-skills",
        "status": "discrepancy",
        "detail": "SKILL.md 写 `npx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g` 与 github.com/agentspace-so/runcomfy-skills，而本仓储物 pin 在 prime-skills/runcomfy-agent-skills（README 也用 runcomfy-agent-skills）。gh api 核实：agentspace-so/runcomfy-skills 仍存在（5★、最后推送 2026-04-29、同样含 flux-kontext 等目录），是另一份较旧的仓；prime-skills/runcomfy-agent-skills 与 agentspace-so/runcomfy-agent-skills 返回相同 stats、full_name 均为 prime-skills/runcomfy-agent-skills（同一仓的新名）。结论：按文档安装可能装到旧版内容。"
      },
      {
        "item": "aspect_ratio 未给枚举值（与同族其他技能不一致）",
        "status": "discrepancy",
        "detail": "本技能写 'Pick from supported W:H options on the model page.'——同仓 happyhorse-1-0/wan-2-7/seedance-v2/gpt-image-edit 都列全了枚举。属于文档详略不一致（未到『错误』程度，但 agent 无法据此校验取值）。"
      },
      {
        "item": "prompt 注入面 vs 文档自述",
        "status": "ok",
        "detail": "正文 'The CLI does NOT shell-expand the prompt' 与 'No shell injection surface from prompt content' 一致陈述；图像侧注入风险在 Limitations/Security 段有自认，未见淡化。"
      },
      {
        "item": "被点名的兄弟技能目录是否真实存在",
        "status": "ok",
        "detail": "nano-banana-edit/、gpt-image-2/、flux-2-klein/ 三个目录经 ls 与 git ls-tree 核实均存在，路由建议不是死链。"
      },
      {
        "item": "无凭证/写入代码路径",
        "status": "ok",
        "detail": "SKILL.md 中 RUNCOMFY_TOKEN 与 token.json 仅出现在 Prerequisites 第 3 条与 Security & Privacy 的 token storage 说明里，均是对 CLI 行为的转述；文件内无 write/save/append 指令指向本地路径，除 --output-dir 产物落地外无写入动作。"
      },
      {
        "item": "元数据（commit/stars/last_push/license/installs）",
        "status": "ok",
        "detail": "本地 HEAD fca19ae084c2ae4667f5c8affbb99da5103d5832；gh api 复核 stars=48、pushed_at=2026-05-15T10:59:51Z、spdx=MIT；仓库根 LICENSE 为 MIT（Copyright (c) 2026 RunComfy / agentspace-so）；installs=412,600 取自池内 skills.sh-alltime 记录。"
      },
      {
        "item": "同步给读者的『CLI 说明书』是否更权威",
        "status": "ok",
        "detail": "同仓 runcomfy-cli/SKILL.md 是 CLI 的自述文档（含 allowed-tools: Bash(runcomfy *) 与 130 退出码），交叉阅读后确认本技能的 How it works 段与该说明书一致（除 Ctrl-C 取消的具体 HTTP 动词在家族内不一致，happyhorse 写 POST .../cancel、runcomfy-cli 写 DELETE）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "fca19ae084c2ae4667f5c8affbb99da5103d5832",
    "sha256": "8c2a39b4f92f3d8248462084579a73fa45f2cf0cb8a00636bff1f3a22b3ef402",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/flux-kontext.tar.gz",
    "sha256": "8c2a39b4f92f3d8248462084579a73fa45f2cf0cb8a00636bff1f3a22b3ef402",
    "commit": "fca19ae084c2ae4667f5c8affbb99da5103d5832"
  },
  "original": {
    "github": "https://github.com/prime-skills/runcomfy-agent-skills/tree/main/flux-kontext",
    "path": "flux-kontext",
    "commit": "fca19ae084c2ae4667f5c8affbb99da5103d5832"
  }
}