{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "marketplace-health-check",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "install_deps",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: marketplace-health-check/scripts/repo-health-check.workflow.js — via Workflow"
    },
    {
      "file": "scripts/ 或 SKILL.md",
      "summary": "Declares dynamic installation of external language package dependencies"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: access to GitHub REST via gh CLI (api.github.com, default gh endpoint, domain not explicitly in repo text): gh repo view / "
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: read-only by design (COMMON prompt and script comments state READ-ONLY: inspectors must not modify files, c"
    }
  ],
  "verification": {
    "method": "第二遍以找茬视角独立复核：① 逐字重读三份源码（SKILL.md 100 行、workflow.js 122 行含全部 dims prompt、methodology 49 行），先用自己的话复写每条第一遍 claim，再回原文找出处，找不到即标 unlocatable；② 反查执行代码：以字符串计数确认 dims 数组恰为 6 项、每个 key 与 SKILL.md 六维一一对应，并确认 parallel/agent/phase 调用真实存在而非文档修辞；③ 反查外部 CLI 与端点：把去重后的命令（gh/git/jq/python3/bash/uv/claude plugin validate/gitleaks）逐个在源码定位，并全仓检索 api.github.com 与 github.com 字样验证「域名未在仓内出现」这一判断；④ 反查安全结论：三处 READ-ONLY 声明与 methodology 的 marker MUTATES 记录对照，找第一遍「完全只读」结论的反例；⑤ 反查资产引用是否真实：daymade-claude-code/marketplace-dev/scripts/check_marketplace.sh、check_doc_skill_lists.py、daymade-skill/skill-creator/scripts/security_scan.py、references/promotion-policy.md 在 pin commit 下逐一确认存在；⑥ 用 glob（含隐藏文件、关闭 gitignore）核对目录资产面。",
    "second_pass": [
      {
        "item": "六维清单与代码 dims 一一对应",
        "status": "ok",
        "detail": "SKILL.md 列的六维（代码/脚本安全、文档 SSOT、安全/PII、开放 PR、开放 issue、marketplace 清单）与 workflow.js 的六个 key（code-and-script-safety / doc-consistency / security-pii / pull-requests / issues / marketplace-integrity）逐项对应，dims 数组经计数恰为 6 项，无多无少。"
      },
      {
        "item": "parallel fan-out 是真实实现而非修辞",
        "status": "ok",
        "detail": "源码含 phase('Inspect') 与 parallel(dims.map(d => () => agent(COMMON + d.prompt, { label: 'check:' + d.key, phase: 'Inspect', schema: CHECK_SCHEMA })))，description 里「parallel fan-out Dynamic Workflow」无夸大。"
      },
      {
        "item": "必须 inline 的运行约束",
        "status": "ok",
        "detail": "SKILL.md 逐字存在该段，且理由（forked subagent 不能 spawn subagents 或启动 workflow）与 workflow 脚本调用 agent()/parallel() 的宿主能力要求自洽。"
      },
      {
        "item": "外部 CLI 调用点真实存在",
        "status": "ok",
        "detail": "gh、jq、git、bash、python3、uv、claude plugin validate、gitleaks 均在 SKILL.md 或 workflow.js 逐字可定位；gitleaks 仅出现在 methodology 对 security_scan.py 实现的描述里，属间接调用（该脚本确实存在于 daymade-skill/skill-creator/scripts/security_scan.py）。"
      },
      {
        "item": "gh 网络端点域名",
        "status": "unlocatable",
        "detail": "仓库内检索 api.github.com / github.com 零命中：skill 只写 gh CLI is authenticated. 与各 gh 子命令，端点域名按 gh CLI 的默认行为推断为 api.github.com，无法在源码内取证，已在 external_deps 与 security.network_calls 中标注该推断。"
      },
      {
        "item": "只读承诺 vs 实际副作用",
        "status": "discrepancy",
        "detail": "脚本注释、COMMON prompt 与 SKILL.md 三处 READ-ONLY 声明针对「文件修改/评论/push」，但 methodology 自述 security_scan.py MUTATES the marker file，并要求 git checkout 还原。故第一遍若把本 skill 概括为「零写入」属过强；准确说法是「对代码与协作面无写入，但被点名执行的扫描器有一条 marker 写副作用，靠人工还原」。"
      },
      {
        "item": "资产引用路径真实存在",
        "status": "ok",
        "detail": "workflow.js 引用的 check_marketplace.sh、check_doc_skill_lists.py 与 security_scan.py 在 pin commit 下均真实存在；SKILL.md 提到「repo 根、bundles 之外的 decline policy 参考文档」对应仓库根 references/promotion-policy.md，CLAUDE.md 亦以 references/promotion-policy.md 指向它。"
      },
      {
        "item": "成本声明可验证性",
        "status": "unlocatable",
        "detail": "「~15-20 min, ~400-500k output tokens」来自该 skill 蒸馏时的实测会话，仓内无基准、日志或脚本可复算，只能视为作者经验值。"
      },
      {
        "item": "仓外全局守卫引用",
        "status": "unlocatable",
        "detail": "workflow.js 的 security-pii 维度提到 owner 全局守卫 ~/scripts/git-pii-guard，该路径在仓库外（属用户私有环境），本仓库无法验证其存在与覆盖范围。"
      },
      {
        "item": "marker 缺口自证",
        "status": "ok",
        "detail": "marketplace-health-check/ 与 notify-wecom/ 目录下均无 .security-scan-passed（glob 含隐藏文件、关闭 gitignore 确认），正好落在这条维度自己要审计的 marker gap 盲区里——与 methodology 描述的现象一致，非矛盾。"
      },
      {
        "item": "SKILL.md 不得自带 version",
        "status": "ok",
        "detail": "本 skill 的 SKILL.md frontmatter 只有 name/description；版本在 .claude-plugin/marketplace.json（marketplace-health-check 1.0.1），符合 methodology 第 5 条 SKILL.md must NOT contain its own version number。"
      },
      {
        "item": "description 能力夸大检查",
        "status": "ok",
        "detail": "description 承诺的六维 + 并行 workflow + 复验后按优先级报告，在 workflow.js 与 SKILL.md 逐一有对应实现；未承诺自动修复或自动评论（SKILL.md 反而明示这些是 owner 决策）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "066980771e4106d81c3b376ec470c86c8c879a39219a191804e4c2b34457366b",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/marketplace-health-check.tar.gz",
    "sha256": "066980771e4106d81c3b376ec470c86c8c879a39219a191804e4c2b34457366b",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/marketplace-health-check",
    "path": "marketplace-health-check",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}