{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "notify-wecom",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "install_deps",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local scripts or commands: This skill contains zero scripts itself (verified via glob including hidden files in notify-wecom/, containing only SKILL.md); it instructs the agent to invoke the companion skill"
    },
    {
      "file": "scripts/ 或 SKILL.md",
      "summary": "Declare dynamic installation of external language runtime dependencies"
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: POST https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=<bot key> (msgtype"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: This skill contains zero write instructions itself"
    }
  ],
  "verification": {
    "method": "第二遍以找茬视角独立复核：① 用 glob（含隐藏文件、关闭 gitignore）确认 notify-wecom/ 目录只有 SKILL.md，逐字重读 82 行全文并用自己的话复写每条结论；② 反向追查每一条外部依赖的归属——把『qyapi.weixin.qq.com / webhook URL / curl / uv / send_wecom.py / set_recipient.py / 4096 / chmod 600』逐个在 notify-wecom/SKILL.md 与 setup-notifications-via-wecom/{SKILL.md,scripts/send_wecom.py} 里检索，标出哪些属于本 skill、哪些属于配套 skill，防止把配套实现记到本 skill 账上；③ 用配套 skill 的 send_wecom.py 头部（CONFIG_PATH、proxy 清理说明、stdlib urllib）与 setup SKILL.md 的 Quick Start 交叉核对配置路径、端点形态与代理纪律；④ 安全结论找反例：全目录检索 base64/eval/exec/HTTP 端点/密钥读取，确认本 skill 无隐藏执行面，并检验『yellow 而非 orange』的理由是否站得住（端点归属、key 用途、无本地执行）；⑤ 夸大检查：把 description 承诺（one-shot、不需要模板或 setup 工作流）与正文实际能力逐条对照。",
    "second_pass": [
      {
        "item": "本 skill 无脚本、无隐藏资产",
        "status": "ok",
        "detail": "glob（hidden=true、gitignore=false）显示 notify-wecom/ 下仅 SKILL.md 一个文件；无 scripts/、references/、templates/，亦无 .security-scan-passed。"
      },
      {
        "item": "WeCom 端点归属",
        "status": "discrepancy",
        "detail": "第一遍若把 qyapi.weixin.qq.com 当作本 skill 自带端点即属越档：notify-wecom/SKILL.md 全文无该域名（只有配置路径与 Tencent endpoints must be reached directly 的泛指），URL 形态与示例出自 setup-notifications-via-wecom/SKILL.md。最终 JSON 已按来源分别标注（网络依赖引配套 skill 原文）。"
      },
      {
        "item": "配置路径与字段",
        "status": "ok",
        "detail": "notify-wecom 与配套 skill 双侧一致：都指向 ~/.config/setup-notifications-via-wecom/config.json，字段为 webhook_url / recipient_scope / recipient_label；send_wecom.py 的 CONFIG_PATH 为同值绝对路径。"
      },
      {
        "item": "self/others 门禁表述一致",
        "status": "ok",
        "detail": "notify-wecom『self 免授权、others 需人工确认、scope 非法即停』与 setup-*『self may send automatically; others requires human confirmation; missing identity fails fast』同义，无矛盾。"
      },
      {
        "item": "交付验证声明",
        "status": "ok",
        "detail": "『authorization alone is not delivery proof』与配套『only the sender response proves delivery』一致，且未夸大为「保证送达」——反而明确 pending item 不是回执。"
      },
      {
        "item": "代理清理的执行方",
        "status": "ok",
        "detail": "notify-wecom 只声明要清空代理变量；实际执行在配套实现里（send_wecom.py 文档串说明会清除 proxy 相关环境变量，inline curl 路径则用 env -u 前缀）。本 skill 是纪律声明方而非执行方，JSON 已如此表述。"
      },
      {
        "item": "4096 字节上限可验证性",
        "status": "unlocatable",
        "detail": "该数字是企微 text 消息的服务端限制，仓内既无对应校验代码也无出处引用（配套 sender 的可见部分为配置加载与重试逻辑）；按文档声明收录，无法在源码取证。"
      },
      {
        "item": "无混淆/无隐藏执行面",
        "status": "ok",
        "detail": "82 行纯文本 markdown，检索 base64/eval/exec/os.system/HTTP 端点/密钥文件读取零命中；shell 代码块仅出现在使用示例的 /notify-wecom 调用行。"
      },
      {
        "item": "description 与实现是否相符",
        "status": "ok",
        "detail": "description 只承诺「发一条一次性消息、不需要可复用模板或 setup 工作流」，正文实现（读配置→身份门禁→发送→报错）与之一致；未承诺富媒体、模板、送达回执或重试治理。"
      },
      {
        "item": "版本归属",
        "status": "ok",
        "detail": "notify-wecom/SKILL.md frontmatter 无 version 字段，版本只在 .claude-plugin/marketplace.json（notify-wecom 1.1.0），符合本仓『版本以 manifest 为 SSOT』的规则。"
      },
      {
        "item": "与仓库叙事一致",
        "status": "ok",
        "detail": "README.md 的 notify-wecom 段落（One-Off WeCom Message / self sends directly, while others requires human confirmation）与 SKILL.md 正文口径一致，安装命令为 claude plugin install notify-wecom@daymade-skills。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "dfbd3822134d853e111dd3e9925331e309d7dee21bb0f5b16e98972ab5a713a9",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/notify-wecom.tar.gz",
    "sha256": "dfbd3822134d853e111dd3e9925331e309d7dee21bb0f5b16e98972ab5a713a9",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/notify-wecom",
    "path": "notify-wecom",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}