{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "motion-doctrine",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "external_write",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: node scripts/seam-stamp.mjs --ledger ledger.json [--write index.html] (reads ledger; -"
    },
    {
      "file": "外部 API",
      "summary": "Performs external publishing, resource creation, or modification writes"
    },
    {
      "file": "环境变量 / API Key",
      "summary": "Reads provider service keys: process.env.CHROME_PATH (used strictly to resolve the Chrome executable path, not a credential)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: seam-stamp.mjs --write <target>: writes generated seam code back to index.html (via writeFileSync, single-file, reversible,"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反向取证（不沿用第一遍结论，直接打开脚本核对调用点）：① 全量文件清单（motion-doctrine/ 4 个文件：SKILL.md + references/seam-gate.md + scripts/seam-gate.mjs + scripts/seam-stamp.mjs）；② token 扫描三份文本（URL / process.env / child_process / fetch / writeFile / spawn / kill / CHROME / KEY|TOKEN|SECRET）：URL 仅 2 处且都是 localhost；process.env 命中 CHROME_PATH 与整环境传递；child_process 命中 spawn 预览服务与 spawn chrome；writeFile 仅 seam-stamp 一处；③ 打开 seam-gate.mjs 前 148 行核对 ensureServer/findChrome 真实实现（端口随机、HYPERFRAME_RUNTIME_URL 被 delete、repoCli 优先、npx 回退、进程组回收）；④ 打开 seam-stamp.mjs 前 63 行确认它只读账本 + 输出/写回 index.html；⑤ 核对 references/seam-gate.md 的 ledger schema 与两脚本实现是否一致；⑥ 用 PyYAML 复采 frontmatter（description 为双引号 scalar，含尾部关键词标签数组）。",
    "second_pass": [
      {
        "item": "是否存在被忽略的第三方数据外发（判蓝的关键反证点）",
        "status": "ok",
        "detail": "对两脚本做 https?:// 全扫：seam-gate.mjs 命中 2 处，均为 `http://localhost:...`（注释示例与端口拼接）；seam-stamp.mjs 零命中。fetch 仅 2 处（httpOk 探活、/api/projects 取项目 id），目标都是 localhost。未发现任何远端域名、遥测、上报或 CDN 请求。判蓝成立。"
      },
      {
        "item": "凭证读取面（是否碰 KEY/TOKEN/cookie）",
        "status": "ok",
        "detail": "process.env 使用点只有 `process.env.CHROME_PATH`（渲染器路径）与 `const env = { ...process.env }` 后 delete HYPERFRAME_RUNTIME_URL 的整环境传递。全脚本无 GEMINI/OPENAI/AWS/HeyGen 等 key 名，无 keychain/.env 读取。判蓝（而非橙）成立。"
      },
      {
        "item": "写盘范围（是否可能误写用户仓库其他文件）",
        "status": "ok",
        "detail": "seam-stamp.mjs 只 writeFileSync(target, html)，target 来自 --write 参数（实践为 index.html），替换范围被 `// <seams:auto>` 标记限定；seam-gate.mjs 只读。无 rm/mkdir/unlink。风险为客户项目内的定点改写。"
      },
      {
        "item": "子进程与清理（是否留下孤儿进程或提权）",
        "status": "ok",
        "detail": "预览服务以 detached: true spawn，并在 process.on('exit') 里 `process.kill(-child.pid, \"SIGTERM\")` 按进程组回收；SIGINT/SIGTERM 处理器以 exit 130 退出；chrome 子进程同样 detached 并在清理里 SIGKILL 进程组。未见 sudo/提权，未见沙箱或权限模式相关危险开关。"
      },
      {
        "item": "SKILL.md 声称的闸门语义是否真由脚本实现（防吹牛）",
        "status": "ok",
        "detail": "SKILL.md 列出 8 类被强制的检查；references/seam-gate.md 给出「检查行 ↔ 规则」对照表；seam-gate.mjs 内可见 EPS_XY=15 / EPS_Z=0.04 / SPEED_RATIO=3 / CARRIER_POS_TOL=12 / CARRIER_SIZE_TOL=0.05 等阈值常量，与文档中「12px 中心 / 5% 尺寸容差」「速度比 >3 报警」一致。声称有实现支撑。"
      },
      {
        "item": "「盖章即合规」是否只是宣传语",
        "status": "ok",
        "detail": "seam-stamp.mjs 从 ledger 生成基础态（首个场景 autoAlpha:1，其余 autoAlpha:0 且归零 transform）与逐缝 wrapper tween，并把 Z 入场按 dir 预设 scale（dir=-1 → 1.25 超大抵达；否则 0.78 从小到大），与接缝检查要求的方向/符号一致——生成端确实按构造满足被检查字段。仍有手写项（match-cut/morph 只给可见性集，载体交接手写），与 SKILL.md 自述一致。"
      },
      {
        "item": "prompt/内容注入面",
        "status": "unlocatable",
        "detail": "seam-gate 的 `--server-cmd` 允许调用者替换实际执行的 shell 命令（默认值安全）。是否存在其他调用方把外部输入拼进该参数，超出本 skill 目录范围（pin 内其他 skill 的调用点未逐一追查），故不在此断言；仅记录该开关的存在与其默认值。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477",
    "sha256": "9280ac3792a44afd0ba16f4ff9d376acf379a5eed9dde74df364d8738ea475c7",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/motion-doctrine.tar.gz",
    "sha256": "9280ac3792a44afd0ba16f4ff9d376acf379a5eed9dde74df364d8738ea475c7",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes/tree/main/.claude/skills/motion-doctrine",
    "path": ".claude/skills/motion-doctrine",
    "commit": "d2f0bc7f34837da54ae22063772d75d75ce26477"
  }
}