{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "ljg-business-model",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: bun skills/ljg-business-model/Tools/Render.ts (validates JSON and generates offline HTML)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: {--output}.html (refuses overwrite if file exists, flag wx)"
    }
  ],
  "verification": {
    "method": "第一遍只读遍历 skills/ljg-business-model 九个文件（SKILL.md、CanvasGuide.md、Example.html/json、Tools 四个文件、agents/openai.yaml）与风险扫描，逐条记录渲染管线、内容合同与安全面。第二遍不沿用第一遍结论，重读 SKILL.md 的『内容合同/生成与验收/Gotchas』、Render.ts 的 validateModel 与 esc/writeFile 调用、Render.test.ts 的边界断言，核对引用逐字可定位并反查漏计的外发、凭据或写盘。",
    "second_pass": [
      {
        "item": "外部调用核验：无网络",
        "status": "ok",
        "detail": "风险扫描『网络请求』无命中；URL 命中全在 CanvasGuide 的来源清单与 HTML 页脚超链接，属标注而非调用，运行期不请求。"
      },
      {
        "item": "脚本行为核验",
        "status": "ok",
        "detail": "Render.ts 仅 import node:fs/promises 与 node:path/node:util；无 fetch/curl、无 child_process、无 env 读取。"
      },
      {
        "item": "写盘核验",
        "status": "ok",
        "detail": "writeFile(output, html, { flag: \"wx\" }) 只写 --output 指定的 HTML，已存在即报错；未发现写其它路径。"
      },
      {
        "item": "注入面反例检查",
        "status": "ok",
        "detail": "Render.test.ts 断言 '<img src=x onerror=\"alert(1)\">' 被转义为实体且不产生 <img src=x，确认文本转义真实生效。"
      },
      {
        "item": "凭证核验：无",
        "status": "ok",
        "detail": "风险扫描『凭证/环境变量』命中为命令里的 $SKILL_DIR 路径变量，非凭据；代码无 env/keychain 读取。"
      },
      {
        "item": "功能声明与实现一致",
        "status": "ok",
        "detail": "frontmatter 声明交付 PNG 与可改 HTML，正文给出 JSON→HTML 渲染、浏览器截图与验收函数，未夸大。"
      },
      {
        "item": "校验契约核对",
        "status": "ok",
        "detail": "九键齐全、每格≤5 条、text≤90、given 需 source_refs、inferred 需 reason、segment 有效均可在 validateModel 中逐条定位。"
      },
      {
        "item": "判级口径复核",
        "status": "ok",
        "detail": "仅本地脚本与本地读写、无外发或凭据，落 blue；页脚外链不改档位。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "9e75497a950d2cc58ab9e6871f76405144687bd9",
    "sha256": "d7d969bf4b2d2093fc68935791a0fb185d3876bdaa67d0a48ca68858c352d6a2",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/ljg-business-model.tar.gz",
    "sha256": "d7d969bf4b2d2093fc68935791a0fb185d3876bdaa67d0a48ca68858c352d6a2",
    "commit": "9e75497a950d2cc58ab9e6871f76405144687bd9"
  },
  "original": {
    "github": "https://github.com/lijigang/ljg-skills/tree/main/skills/ljg-business-model",
    "path": "skills/ljg-business-model",
    "commit": "9e75497a950d2cc58ab9e6871f76405144687bd9"
  }
}