{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "flyworks-avatar-video",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: python scripts/hifly_client.py <list_public_avatars|list_public_voices|crea"
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: https://hfw-api.hifly.cc/api/v2/hifly (avatar/list, voice/list, video/create_b"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: load_memory/save_memory writes aliases to memory.json in the script directory."
    }
  ],
  "verification": {
    "method": "第一遍通读 SKILL.md/README/references 与 hifly_client.py 全量源码，逐函数记录认证、端点、上传、轮询与写盘；第二遍独立重读脚本，对照 §3 风险扫描的 URL/凭证/网络/写盘命中逐条回源确认，并专找「是否漏报网络调用或隐藏脚本」。",
    "second_pass": [
      {
        "item": "网络端点全部指向 hfw-api.hifly.cc",
        "status": "ok",
        "detail": "requests.get/post/put 的 url 均由 BASE_URL 或上传返回的 upload_url 构造，扫到 11 处请求调用，无额外域名。"
      },
      {
        "item": "凭证读取点",
        "status": "ok",
        "detail": "仅 get_token() 读 HIFLY_API_TOKEN，源码第 15 行；默认 token 第 11 行硬编码。"
      },
      {
        "item": "写盘面",
        "status": "ok",
        "detail": "仅 save_memory 写 memory.json（第 34 行）；未见其它文件写入。"
      },
      {
        "item": "是否有隐藏/混淆脚本",
        "status": "ok",
        "detail": "目录清单仅 9 个文本文件，无二进制/混淆体；扫描沙箱与危险旗标 0 命中。"
      },
      {
        "item": "能力声明与代码相符",
        "status": "ok",
        "detail": "SKILL/README 声称的公共头像、说话照片、声音克隆在脚本中均有对应函数与端点。"
      },
      {
        "item": "默认 token 有效性声明",
        "status": "ok",
        "detail": "源码与 references/authentication.md 一致：demo token 自动启用，30s 上限且带水印。"
      },
      {
        "item": "安装方式",
        "status": "ok",
        "detail": "README 的 `npx skills add Flyworks-AI/skills` 属宿主安装行为，非本目录执行，故不计入档位。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c",
    "sha256": "a042e06284f412180322bd8faa143b5a49f86fd6fe6b6bfa6647eabf9204e6f6",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/flyworks-avatar-video.tar.gz",
    "sha256": "a042e06284f412180322bd8faa143b5a49f86fd6fe6b6bfa6647eabf9204e6f6",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  },
  "original": {
    "github": "https://github.com/freestylefly/canghe-skills/tree/main/skills/flyworks-avatar-video-1.0.0",
    "path": "skills/flyworks-avatar-video-1.0.0",
    "commit": "dd0bf355955b4c82b764740b4183c86a72ba0e0c"
  }
}