{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "huashu-design",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: scripts/render-video.js / render-video-seek.js / verify.js / verify-video.s"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: scripts/cloud/ai-review-video.py → ark.cn-beijing.volces.com (Volcengine Ark)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: Project deliverables: main HTML, design-demos/*.html, screenshots, exported MP4/GIF/PDF/PPTX"
    }
  ],
  "verification": {
    "method": "以 bundle（唯一证据来源）逐条回源复核：① 档位按「只判 skill 自身目录」口径，把核心本地管线与目录内 scripts/cloud/* 的外发/凭证行为拆开评估，得出 orange；② 逐条打开 how_it_works/capabilities/external_deps 的引用核对拼写与上下文，quote 一律取自 bundle §2 展开文件（SKILL.md、README.md、package.json、scripts/sfx-cues.sh）或风险扫描逐行命中的原行；③ 反查「零网络零 key」声明与目录内云脚本的矛盾，结论写入 second_pass；④ 核对 meta：license/stars/last_push/installs 按骨架核定值保留（installs 无可定位值）；⑤ 复核判级六档口径与注入面（WebSearch 结果、用户素材、hook、eval）；⑥ 复核报告权威性：所有结论只对 pin commit 0830494 有效。",
    "second_pass": [
      {
        "item": "README 宣称「core pipeline 100% locally, zero network calls, zero API keys」与目录内 scripts/cloud/* 是否矛盾",
        "status": "discrepancy",
        "detail": "声明仅覆盖核心管线（design → render → MP4/PDF/PPTX export），成立；但 skill 目录自带 scripts/cloud/tts-doubao.mjs 与 ai-review-video.py，会读自备 env key 并把用户成片/文案外发火山方舟与豆包 TTS。二者并行不冲突，但判级须按目录取 orange 而非 green/blue。"
      },
      {
        "item": "三方向硬门是否真的可执行、有完整实现路径",
        "status": "ok",
        "detail": "SKILL.md 给出 Fallback Phase 1-5 完整流程、subagent 串/并行规范、三方向初稿形态（网页/信息图/原型 1 HTML+截图，deck 2 页，动画 1 张方向板）、唯一豁免三情形与 direction-approved.md 落档；README 以「设计方向顾问」条目与 demo 佐证。"
      },
      {
        "item": "Gate 文件与 hook 是否真实存在且可被硬拦",
        "status": "ok",
        "detail": "SKILL.md 列出 brand-spec.md / direction-approved.md / 导演稿.md 三 Gate 文件与 scripts/design-gate-hook.sh（≥45s 长片渲染前硬检查，SKIP_DESIGN_GATE=1 显式放行）；弱 runtime 降级模式第 5 条明确不豁免 gate 文件。"
      },
      {
        "item": "品牌资产 5 步硬流程与具名 logo 子门是否成立",
        "status": "ok",
        "detail": "正文给出「问→搜官方渠道→下载（三条兜底）→验证+提取→固化 brand-spec.md」五步，并规定单文件 HTML 必须 base64 内嵌 logo/图片，缺一即 STOP；README 有对应的品牌资产协议 5 步 showcase。"
      },
      {
        "item": "动画音视频管线（HyperFrames 默认 / 60fps / BGM+SFX 双轨）是否可落地",
        "status": "ok",
        "detail": "正文点名 render-video.js、render-video-seek.js --fps=60、convert-formats.sh、add-music.sh、sfx-cues.sh 与 37 个预制 SFX、6 首 BGM；scripts/sfx-cues.sh 原文可读，ffmpeg amix 混音实现成立。"
      },
      {
        "item": "meta.installs 是否有可定位到本 skill 的安装量",
        "status": "unlocatable",
        "detail": "README 只给仓库级命令 `npx skills add alchaincyf/huashu-design`，无 per-skill 安装计数；骨架 installs=null，维持 null。"
      },
      {
        "item": "security.scripts_executed 清单是否穷举",
        "status": "unlocatable",
        "detail": "风险扫描显示「执行外部程序 121 条命中」「写盘 17 条」，bundle 每类只列最多 6 条样例，且 §1 只列最大 60 个文件（共 191）。当前清单依据 bundle §1/§2 与风险扫描命中项归纳，可能仍漏列个别脚本；只读侦查未运行任何脚本，不跨 commit 推广。"
      },
      {
        "item": "scripts/verify-video.sh 的 eval 是否构成注入风险",
        "status": "ok",
        "detail": "风险扫描命中沙箱/未受控执行：`FPS=$(python3 -c \"print(round(eval('${FPS_RAW:-0}' ...`，eval 的输入为 ffprobe 解析出的帧率原始串，非用户任意输入，风险有限，但属脚本内动态求值，记入 risks。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "0830494ecb1c117e25b313a8114fe55a6bf2b125",
    "sha256": "17cee9ca3b7bc336b3858c32c08c05fd9acbdb0c1d599526b6850b13710fbb32",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/huashu-design.tar.gz",
    "sha256": "17cee9ca3b7bc336b3858c32c08c05fd9acbdb0c1d599526b6850b13710fbb32",
    "commit": "0830494ecb1c117e25b313a8114fe55a6bf2b125"
  },
  "original": {
    "github": "https://github.com/alchaincyf/huashu-design",
    "path": "",
    "commit": "0830494ecb1c117e25b313a8114fe55a6bf2b125"
  }
}