{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "motion-frames",
  "built": "2026-10-26",
  "control_level": 3,
  "control_level_label": "L3 联网",
  "capabilities": [
    "network"
  ],
  "required_controls": {
    "agent": [
      "declare_domain_and_key_scope"
    ],
    "admin": [
      "least_privilege_keys",
      "keep_request_logs"
    ]
  },
  "evidence": [
    {
      "file": "网络端点",
      "summary": "Declared external network access: Artifact side (mandated by shared design directives): Generated HTML imports cdn.tailwindcss.com (Tailwind Play) and Google F in the browser"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 重列目录全量文件（2 个：SKILL.md、example.html），核对资产面；② 目录递归 token 扫描（凭证/子进程/网络/写盘关键字）与 SKILL.md 端点关键字扫描各跑一遍，坐实\"纯指令\"；③ 对每个 external_deps 条目回源到 shared.ts / argv.ts / example.html 原文；④ 反向核对宿主执行链（loader→assemblePrompt→invoke spawn→stdout 捕获）与预览 iframe 的 sandbox 属性，确认风险归属宿主；⑤ 官方描述与正文逐条比对，检查夸大；⑥ git HEAD 与任务 pin 比对。",
    "second_pass": [
      {
        "item": "skill 目录资产面（脚本 / references / 数据 / 模板）",
        "status": "ok",
        "detail": "目录实为 2 个文件：SKILL.md 与 example.html；无 scripts/、无 references 目录、无任何可执行文件（.sh/.py/.js/.mjs/.ts 零命中）。"
      },
      {
        "item": "「无脚本、无网络、无凭证、无写盘」的反例搜索",
        "status": "ok",
        "detail": "对目录递归 token 扫描（api[_-]?key|token|secret|\\.env|process\\.env|child_process|fetch\\(|curl |wget |npm |npx |exec\\(|subprocess|writeFile|fs\\.）：零命中；SKILL.md 另按 http|CDN|cdn|font|API|api|fetch|Google|script 扫描，仅命中 font-semibold / font-black 这类字重类名，无端点。"
      },
      {
        "item": "官方描述 vs 实际能力（有无夸大）",
        "status": "ok",
        "detail": "frontmatter description（可循环 CSS 动效组合: 旋转环、地球仪、计时器、视差标签）与正文一致：描述承诺的版式要素都能在正文找到对应条目，未见正文未支持的越界承诺。"
      },
      {
        "item": "外部资源/工具条目逐条回源",
        "status": "ok",
        "detail": "external_deps 中的仓库级条目（Tailwind Play CDN / jsdelivr / Google Fonts / 本机 agent CLI）逐条回到 shared.ts 与 argv.ts 原文取证；本模板无目录级端点条目。"
      },
      {
        "item": "宿主执行链（供 security.reason / verdict.risks 使用，不参与判级）",
        "status": "ok",
        "detail": "prompt 经 stdin 送入被 spawn 的本机 CLI（invoke.ts），HTML 从 stdout 分流捕获；claude 参数含 --permission-mode bypassPermissions、envFor 透传 process.env；预览 iframe sandbox=\"allow-scripts allow-same-origin\"（template-picker.tsx:544 / preview-pane.tsx:297）。"
      },
      {
        "item": "路径与 commit 一致性",
        "status": "ok",
        "detail": "工作副本 /var/ytdown/skills-portal/spy-repos/html-anything 的 git HEAD = 553ed98c283f9c0f489902d035416a972d6a9699（与任务表 pin 一致）；skill.path=next/src/lib/templates/skills/motion-frames 下确有 SKILL.md，全仓无第二份同名模板。"
      },
      {
        "item": "\"CSS 动效\"是否借道外部动画库",
        "status": "ok",
        "detail": "SKILL.md 明确\"纯 CSS 动效, 流畅可循环\"，未要求引入 GSAP/Lottie 等库；example.html 中无 <script>、无 CDN 外链，动效由内联 CSS 实现，故不存在外部动画依赖。"
      },
      {
        "item": "是否真的无 JS",
        "status": "ok",
        "detail": "SKILL.md 允许\"JS 可有可无\"，即产物里可能含可选 JS，但那是交给模型写进产物（自包含），不是 skill 调外部脚本；skill 目录内无任何 JS 文件。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699",
    "sha256": "6c0a8c77753d9758131926843502ffb0c256e104b159f27b060aff9dfc96d7eb",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/motion-frames.tar.gz",
    "sha256": "6c0a8c77753d9758131926843502ffb0c256e104b159f27b060aff9dfc96d7eb",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699"
  },
  "original": {
    "github": "https://github.com/nexu-io/html-anything/tree/main/next/src/lib/templates/skills/motion-frames",
    "path": "next/src/lib/templates/skills/motion-frames",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699"
  }
}