{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "javascript-animation",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: node scripts/render.mjs piece.html sheet.jpg --sheet 1 / --stills 90,300,61"
    },
    {
      "file": "网络端点",
      "summary": "External network access declaration: The skill's scripts make no outbound business requests: Playwright accesses local file:// pages, and ffmpeg/ffprobe only read local files"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: <out>.mp4 (full video), <out>-<frame>.jpg (still frames), contact sheet image named via out parameter (render.mjs)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 逐文件读自带脚本（render.mjs / asset-audit.mjs / layout-check.mjs）确认其子进程、网络与写入行为，而不是只看 SKILL.md 的描述；② token 扫描（URL / fetch / process.env / child_process / writeFile / mkdtemp / API_KEY|TOKEN|SECRET / sandbox|bypass|no-verify）逐条回源；③ 反向验证：SKILL.md 里每条命令是否对应存在且路径正确的文件；④ 交叉验证隐私声明：SKILL.md 的「Photos stay local」与 character.md 第 6 条是否同口径；⑤ 与同仓 soundtrack、同族 webgl skills 交叉比对档位逻辑（本 skill blue，soundtrack 因读 $OPENROUTER_API_KEY 判 orange）。",
    "second_pass": [
      {
        "item": "脚本是否真的无网络外发（蓝档的关键）",
        "status": "ok",
        "detail": "三个 .mjs 逐个读过：render.mjs 只 spawn ffmpeg 与 playwright 打开 file:// 页面；asset-audit.mjs 的 live check 只监听请求并打印；layout-check.mjs 只 evaluate window.draw/LAYOUT。skill 目录内无 fetch/http 调用点。"
      },
      {
        "item": "是否有凭证/环境变量读取",
        "status": "ok",
        "detail": "`process.env|API_KEY|TOKEN|SECRET|Authorization` 在本仓命中仅一处：skills/soundtrack/references/ai-music.md 的 $OPENROUTER_API_KEY（属 soundtrack）。本 skill 内零命中，credential_reads 为空成立。"
      },
      {
        "item": "是否有更高的触发条件被漏掉（红档特征）",
        "status": "ok",
        "detail": "`sandbox|automationcontrolled|no-verify|stealth|bypass|dangerously` 全仓零命中；浏览器以默认方式启动（`chromium.launch({ channel: 'chrome' })`，无 stealth 补丁、无关 TLS/沙箱开关）。"
      },
      {
        "item": "SKILL.md 引用的脚本与模板是否都真实存在（有无示意命令）",
        "status": "ok",
        "detail": "四条命令逐条核对到真实文件：scripts/render.mjs、scripts/asset-audit.mjs、scripts/layout-check.mjs、templates/starter.html 均在 skill 目录内；跨 skill 的 ../soundtrack/scripts/sync-check.mjs 在同仓兄弟 skill 目录内存在。无空引用。"
      },
      {
        "item": "「zero-asset」是否是可执行契约而非口号",
        "status": "ok",
        "detail": "asset-audit.mjs 有 13 条静态规则（含 data: URI、@font-face、动态 import、base64 大块）与一次实跑网络记录，命中即 exit 1；qc.md 把 'asset-audit CLEAN' 列为交付前第一道门禁。契约可执行。"
      },
      {
        "item": "「照片只本地」的隐私声明是否两处一致且可定位",
        "status": "ok",
        "detail": "SKILL.md 触发条件表内 'Photos stay local: never upload them or put them in anything published.'；character.md 第 6 步 'Photos are for looking at locally. Never upload them, embed them, or put them in anything published.' 两处同口径，无矛盾。"
      },
      {
        "item": "「每帧是帧号的纯函数」是否与 starter/render 实现相符",
        "status": "ok",
        "detail": "starter.html 顶部注释写死契约（不许 Math.random/Date，用 rng(seed)/hash2，任意帧可单独渲染），render.mjs 只调用 window.draw(f) 取 dataURL、不做时间推进；两侧一致，声明属实。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f",
    "sha256": "cf575d5199b6a4edffda9db8e1247859158e12918f6a8b9cce778eb8a7defb87",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/javascript-animation.tar.gz",
    "sha256": "cf575d5199b6a4edffda9db8e1247859158e12918f6a8b9cce778eb8a7defb87",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f"
  },
  "original": {
    "github": "https://github.com/iart-ai/javascript-animation-skills/tree/main/skills/javascript-animation",
    "path": "skills/javascript-animation",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f"
  }
}