{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "guizang-social-card-skill",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: validate-social-deck.mjs (Node + playwright chromium, renders and measures task HTML locally)"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: Execution phase (active agent fetch): https://unsplash.com/s/photos/<keyword>, https://www.pexels."
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Task directory (default local-tests/<slug>/, or user-specified path): index.html, assets under assets/, rendered images under output/"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全目录文件清单核对资产面（SKILL.md、README/README.en/PRODUCT/HANDOFF/AGENT/COMMERCIAL_LICENSING、references×16、assets/template-*.html + screenshot-backgrounds/*.webp、scripts×7、validate-social-deck.mjs、package.json/package-lock.json、agents/openai.yaml、LICENSE）；② 通读 package.json 与各脚本头部，确认依赖与外部命令（playwright、ffprobe/ffmpeg、makelive、swift）；③ 逐类 token 扫描：把 URL 分为「执行期抓取（图库/Mapbox）」与「产物期引用（Google Fonts/unpkg）」两类，并各自标出所属文件；④ 凭证扫描确认无 env/keychain/配置文件读取，Mapbox 处仅 YOUR_TOKEN 占位；⑤ 核对 SKILL.md 里提到 16 份 references 是否都真实存在；⑥ 核对 HANDOFF.md 的目录结构与实际文件是否一致；⑦ 夸大检查：description 声称的社交卡组/实况照片/封面成对/Swiss 与杂志风，都由模板+配方+校验器+Live Photo 文档落地，无越界承诺（不承诺一键发布、不承诺版权免责）。",
    "second_pass": [
      {
        "item": "图库端点属执行期抓取（判黄依据）",
        "status": "ok",
        "detail": "SKILL.md「Web-Sourced Images (fallback when user has none)」段列出五个来源与 URL，并给出执行命令「Use WebFetch or `curl` to download the image into the task folder's `assets/` directory.」——是 agent 主动抓取，非仅产物引用。"
      },
      {
        "item": "模板 CDN 属产物期引用（不判级）",
        "status": "ok",
        "detail": "template-swiss-card.html 引用 https://fonts.googleapis.com/... 与 https://unpkg.com/lucide@latest/dist/umd/lucide.min.js，template-editorial-card.html 引用 fonts.googleapis.com/fonts.gstatic.com——均发生在浏览器渲染产物时，按批4 口径只写 reason/risks。"
      },
      {
        "item": "Mapbox token 的性质",
        "status": "ok",
        "detail": "map-component.md 中 URL 形如 `...&access_token=YOUR_TOKEN`，为使用者自备占位；skill 不读环境变量、不读配置文件，故不算凭证读取。"
      },
      {
        "item": "脚本依赖与外部命令",
        "status": "ok",
        "detail": "package.json dependencies 仅 playwright ^1.60.0，scripts 定义 test:docs 与 validate；make-video-contact-sheet.py 用 subprocess 调 ffprobe/ffmpeg；package-live-photo.py 导入 makelive（文档要求 uvx --from 'makelive==0.7.0'）；validate-social-deck.mjs `import { chromium } from \"playwright\"`。"
      },
      {
        "item": "references 完整性",
        "status": "ok",
        "detail": "SKILL.md 列出的 16 份 references（platform-specs / style-system / theme-presets / layout-recipes / components / background-systems / portrait-fill / content-planning / production-workflow / live-photo-production / image-overlay / screenshot-treatment / map-component / title-shortener / category-cookbook / qa-checklist）在仓库中全部存在，无死引用。"
      },
      {
        "item": "校验器规则与 SKILL.md 描述一致",
        "status": "ok",
        "detail": "validate-social-deck.mjs 头注释的 R1-R9 与 SKILL.md「It checks overflow (R1)…title-to-content gaps (R9). Exit code 1 on any FAIL」逐条对应。"
      },
      {
        "item": "产物放置纪律",
        "status": "ok",
        "detail": "SKILL.md「Generated work must live in a task folder, not in the skill root.」+ AGENT.md「不要把一次性的生成案例、渲染输出、临时素材、调试脚本或下载图片直接放在 Skill 根目录。」两处一致，且 .gitignore 忽略 local-tests/。"
      },
      {
        "item": "版权处理流程",
        "status": "ok",
        "detail": "「Policy: grab first, disclose after, let the user decide on attribution.」+ 抓后模板「⚠️ 版权未经核实。请你判断是否可用。」+ SOURCES.md 溯源要求；SKILL.md 明确「we do not pull from paid stock sites（视觉中国 / Getty / 站酷海洛等）」。"
      },
      {
        "item": "Live Photo 依赖链",
        "status": "ok",
        "detail": "references/live-photo-production.md 给出 uvx makelive 与 ffmpeg 命令；scripts/ 提供打包与 contact sheet 两个 Python 封装，另有两个 Swift 兜底脚本（需 macOS Swift 工具链 + AVFoundation）。"
      },
      {
        "item": "许可如实记录（AGPL-3.0）",
        "status": "ok",
        "detail": "LICENSE 全文为 GNU AFFERO GENERAL PUBLIC LICENSE Version 3；GitHub API spdx=AGPL-3.0；另有 COMMERCIAL_LICENSING.md 说明商业合作与平台接入授权方式。"
      },
      {
        "item": "commit / 元数据",
        "status": "ok",
        "detail": "pin 目录 HEAD＝cf4b810fac1c73fb65a2bb31d8c9278d82cbc4c5（与任务表一致）；GitHub API：stars 7045、pushed_at 2026-07-01T16:39:11Z、spdx=AGPL-3.0；HANDOFF.md 记录版本 v0.15（2026-07-01）。"
      },
      {
        "item": "宿主清单",
        "status": "ok",
        "detail": "agents/openai.yaml 声明 display_name「Guizang Social Card Skill」、brand_color #002FA7、default_prompt（含「3:4 social card set, Live Photo card, and paired WeChat cover」）与 policy.allow_implicit_invocation: true。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "cf4b810fac1c73fb65a2bb31d8c9278d82cbc4c5",
    "sha256": "e86ce5a878f51bd8ac494fa6bf0c4b0aed6a9e1d9c105de7cfa6677abf171311",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/guizang-social-card-skill.tar.gz",
    "sha256": "e86ce5a878f51bd8ac494fa6bf0c4b0aed6a9e1d9c105de7cfa6677abf171311",
    "commit": "cf4b810fac1c73fb65a2bb31d8c9278d82cbc4c5"
  },
  "original": {
    "github": "https://github.com/op7418/guizang-social-card-skill",
    "path": "",
    "commit": "cf4b810fac1c73fb65a2bb31d8c9278d82cbc4c5"
  }
}