{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "gpt-taste",
  "built": "2026-10-26",
  "control_level": 3,
  "control_level_label": "L3 联网",
  "capabilities": [
    "network"
  ],
  "required_controls": {
    "agent": [
      "declare_domain_and_key_scope"
    ],
    "admin": [
      "least_privilege_keys",
      "keep_request_logs"
    ]
  },
  "evidence": [
    {
      "file": "网络端点",
      "summary": "Declared external network access: picsum.photos — the skill itself does not initiate requests, but requires generated page code to reference https://picsum.photos"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 对 6 个目标 skill 逐目录 find 全量文件，确认无脚本/引用/模板/数据文件；② 逐文件正则扫描 URL/curl/wget/fetch/exec/subprocess/api_key/token/secret/.env/npm/pip/python 等 token，逐一核实命中项是『指令文本』还是『真实调用』；③ 对每条 evidence.quote 做字面子串校验（脚本比对原文，非人眼）；④ git ls-files + rev-parse 确认路径与 HEAD==origin/main==ccbc156；⑤ gh api 复核 license/stars/pushed_at；⑥ 功能声明 vs 实际能力夸大检查：description 里 'Python-driven true randomization' 与正文 'simulate a Python script execution' 一致，但『Python-driven』属修辞——无真实 Python 依赖，已在 how_it_works 显式标注。",
    "second_pass": [
      {
        "item": "『Python-driven』是否意味着真实脚本/执行面",
        "status": "ok",
        "detail": "反查全文只出现 'simulate a Python script execution' 与 'Write a 3-line mock Python output' 两处；目录内无 .py，无 exec/subprocess/pip 指令。结论：纯提示词层面的伪执行，无代码执行面。"
      },
      {
        "item": "外部依赖清单完整性",
        "status": "ok",
        "detail": "token 扫描命中项全部核实：picsum.photos（§7 图片源）、@gsap/react+ScrollTrigger（§5）、Tailwind grid-flow-dense（§4）、@phosphor-icons/react（§6）；此外 §1/§3 提到字体名 Satoshi / Cabinet Grotesk / Outfit / Geist 与禁用 Inter——为字体选型建议，非包依赖，故未计入 external_deps。"
      },
      {
        "item": "是否存在隐藏网络调用或凭证读取",
        "status": "ok",
        "detail": "api_key / token / secret / .env / keychain / credential 等 token 零命中；无任何外发端点声明。"
      },
      {
        "item": "元数据（license / stars / last_push）",
        "status": "ok",
        "detail": "gh api repos/leonxlnx/taste-skill：spdx MIT、stargazers 87309、pushed_at 2026-08-24T15:23:56Z（= 本地 HEAD 提交时间 2026-08-24T23:23:56+08:00）。此处 stars 为 2026-09-15 实测值，与库内批1快照（84793）不同属正常增长。"
      },
      {
        "item": "路径与 commit 归属",
        "status": "ok",
        "detail": "git ls-files 确认 skills/gpt-tasteskill/SKILL.md 存在；HEAD == origin/main == ccbc15639c97057cbfcf32ecebc38ef716e4bb37，工作树干净。"
      },
      {
        "item": "frontmatter 声明与实际内容是否相符（夸大检查）",
        "status": "ok",
        "detail": "description 列的 AIDA、2–3 行排版、防止 6 行换行、gapless bento、GSAP ScrollTrigger（pinning/stacking/scrubbing）、inline micro-images、超大分区间距，逐项在 §2/§3/§4/§5/§6 找到对应正文；唯一措辞夸大点是 'Python-driven true randomization'（实为模拟），已记录。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "ccbc15639c97057cbfcf32ecebc38ef716e4bb37",
    "sha256": "f0a8eb4dbb6682aff1d2a076a157d16ca1f9a98261810d3ddc0ea3ec8de44320",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/gpt-taste.tar.gz",
    "sha256": "f0a8eb4dbb6682aff1d2a076a157d16ca1f9a98261810d3ddc0ea3ec8de44320",
    "commit": "ccbc15639c97057cbfcf32ecebc38ef716e4bb37"
  },
  "original": {
    "github": "https://github.com/leonxlnx/taste-skill/tree/main/skills/gpt-tasteskill/SKILL.md",
    "path": "skills/gpt-tasteskill/SKILL.md",
    "commit": "ccbc15639c97057cbfcf32ecebc38ef716e4bb37"
  }
}