{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "interface-design",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: `.githooks/pre-commit` (bash): `VERSION=$(date +\"%Y.%-m.%-d.%H%M\")` -> `sed -i"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: The skill core (SKILL.md + two commands + reference/) makes zero network calls: no curl/wget/fetch call sites or HTTP calls in files"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: `.githooks/pre-commit` modifies two manifests in place and runs git add (only occurs if hook is wired up)."
    }
  ],
  "verification": {
    "method": "第一遍：只读通读全仓 15 个文件（SKILL.md 全文、两个 slash command、openai.yaml、reference/ 三份模板、.githooks/pre-commit、两个 manifest、README、website/.vercel 残留），按 file+line+逐字 quote 取证。第二遍独立复核（换角度找茬）：①对 SKILL.md / design-review.md / design-deslop.md / README.md / .githooks/pre-commit / plugin.json 的关键结论逐条重读并重取行号（本报告 quote 行号均经二次 grep 定位确认）；②对 security 四类做独立 token 扫描（env/keychain/curl/wget/npm 生命周期/写路径/删除动作），确认无遗漏的网络与凭证通道；③核对 hook 是否真的会被触发（.git/config 无 core.hooksPath、.git/hooks 仅 *.sample）；④核对 pin：.git/logs/HEAD 与 .git/refs/heads/main 均为 2f9be3206855bcb2d1d0af262c8bae25cba6658d；⑤把 README 的对外宣称与代码/文件实际对照，找夸大处。",
    "second_pass": [
      {
        "item": "skill.path = .claude/skills/interface-design",
        "status": "ok",
        "detail": "重读根目录与 `.claude/` 目录树：确为 `.claude/skills/interface-design/`（内含 SKILL.md 与 agents/openai.yaml），同层还有 `.claude/commands/`（design-review.md、design-deslop.md）；无 .claude/settings.json、无 hooks 目录，全仓仍为 15 个文件。"
      },
      {
        "item": "official_desc 逐字",
        "status": "ok",
        "detail": "重读 SKILL.md L1-4，frontmatter 仅 name/description 两键，description 为单行长文本；与 README『What This Does』口径一致（同为『Not for marketing』）。"
      },
      {
        "item": "external_deps：渲染/出图工具为条件式而非硬依赖",
        "status": "ok",
        "detail": "重读 SKILL.md L74（含 `Never assume the tool exists; check, then use it.` 与无工具时的 fallback 句）、L269（`if an image-generation tool is available`）与 design-deslop.md L18（`If a render tool (`show_widget`/`visualize`) or a screenshot is available, use it.`）。三处均为条件式，无硬依赖。"
      },
      {
        "item": "external_deps：npx skills add / 组件库建议",
        "status": "ok",
        "detail": "重读 README.md L63/70/73/74/77/80/92/111/126 与 L133 兼容性表，均出现在 bash 代码块中，是给用户的安装说明；重读 SKILL.md L181 确认 Radix/React Aria 等仅为给消费方项目的选型建议，本仓无 package.json、不安装任何依赖。"
      },
      {
        "item": "security：pre-commit 是否会被自动触发",
        "status": "discrepancy",
        "detail": "重读 `.githooks/pre-commit` 全 18 行与 `.git/config`：配置里只有 core/repositoryformatversion/filemode/bare/logallrefupdates、remote origin、branch main，**没有 core.hooksPath**；`.git/hooks/` 全是 *.sample。结论：clone 后不会自动执行（常见说法『克隆即触发 git hook』不成立）。附带发现脚本用 `sed -i ''`（BSD/macOS 语法），在 GNU sed 上会报错，进一步说明是作者本机工作流。"
      },
      {
        "item": "security：凭证读取与网络外发为零",
        "status": "ok",
        "detail": "全仓独立扫描 env/keychain/token/secret/curl/wget/.env 等 token：唯一命中是 SKILL.md 的 `## Tokens` 标题与 marketplace.json 的 'tokens' tag（设计 token 语义，非凭证）。.githooks、.claude/、reference/、website/ 正文逐一见底，无任何凭证或网络访问点。"
      },
      {
        "item": "security：file_writes 的两条路径",
        "status": "ok",
        "detail": "重读 .githooks/pre-commit L10/13/16（写 .claude-plugin 两个 JSON + git add）与 SKILL.md L303（写消费方项目 `.interface-design/system.md`）。两条写入路径都限定在各自工作目录之内，不触碰 $HOME 与系统目录。"
      },
      {
        "item": "宣称 vs 实际：reference/ 是否随 skill 安装",
        "status": "discrepancy",
        "detail": "重读 plugin.json L11-12（commands=./.claude/commands、skills=./.claude/skills）与 README.md L328-330（`For system file templates, see `reference/examples/`:`）。reference/ 位于仓库根、不在发布目录内，全仓仅 README 引用它（SKILL.md 与两个命令零引用），因此走 README 推荐的 npx 安装后这些模板不会落地，README 该指引对安装用户是悬空引用。"
      },
      {
        "item": "宣称 vs 实际：『Memory / System loads automatically』",
        "status": "discrepancy",
        "detail": "重读 README.md L32（`3. **Memory** — Save decisions to `.interface-design/system.md`, then reload them when the skill runs`）与 SKILL.md L288/L303：真实机制是 prompt 要求 agent 主动读、并在用户同意后写，没有任何代码或 hook 保证自动加载/落盘，『automatically』只是提示词层面的期望。"
      },
      {
        "item": "website/ 的性质",
        "status": "ok",
        "detail": "重读 website/.vercel/README.txt（Vercel 自动生成，自述不应分享该目录）与 project.json（projectId/orgId/projectName 单行 JSON）：目录内无任何 HTML/JS/CSS，站点实际托管在外部域名 interface-design.dev；仓库无 .gitignore 故该目录被提交，属无意的信息残留而非功能组件。"
      },
      {
        "item": "pin 与许可证",
        "status": "ok",
        "detail": "重读 .git/logs/HEAD 与 .git/refs/heads/main：均为 2f9be3206855bcb2d1d0af262c8bae25cba6658d，与任务书 pin 一致；重读 LICENSE L1/L3 确认为 MIT（Copyright (c) 2026 Damola Akinleye）。"
      },
      {
        "item": "宣称 vs 实际：Compatibility Matrix 的可验证性",
        "status": "discrepancy",
        "detail": "README L129-135 用表格宣称多 agent 兼容（Claude Code / Codex / Cursor 等），但 .github/ 下仅 FUNDING.yml，全仓无 workflows、无 package.json、无测试，该矩阵在仓库内没有任何测试或 CI 支撑。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "2f9be3206855bcb2d1d0af262c8bae25cba6658d",
    "sha256": "83166a71a36953ec672527dfaceb4dfd243c342fc57ec15f3e124a44b3f4cae6",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/interface-design.tar.gz",
    "sha256": "83166a71a36953ec672527dfaceb4dfd243c342fc57ec15f3e124a44b3f4cae6",
    "commit": "2f9be3206855bcb2d1d0af262c8bae25cba6658d"
  },
  "original": {
    "github": "https://github.com/Dammyjay93/interface-design/tree/main/.claude/skills/interface-design",
    "path": ".claude/skills/interface-design",
    "commit": "2f9be3206855bcb2d1d0af262c8bae25cba6658d"
  }
}