{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "poster-hero",
  "built": "2026-10-26",
  "control_level": 3,
  "control_level_label": "L3 联网",
  "capabilities": [
    "network"
  ],
  "required_controls": {
    "agent": [
      "declare_domain_and_key_scope"
    ],
    "admin": [
      "least_privilege_keys",
      "keep_request_logs"
    ]
  },
  "evidence": [
    {
      "file": "网络端点",
      "summary": "Declared external network access: No network request code exists within the directory; the bundled example.html references https://cdn.tailwindcss.com in <head> (an external link in the example artifact,"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 重列目录全量文件（3 个：SKILL.md、example.html、example.md），核对资产面；② 目录递归 token 扫描（凭证/子进程/网络/写盘关键字）与 SKILL.md 端点关键字扫描各跑一遍，坐实\"纯指令\"；③ 对每个 external_deps 条目回源到 shared.ts / argv.ts / example.html 原文；④ 反向核对宿主执行链（loader→assemblePrompt→invoke spawn→stdout 捕获）与预览 iframe 的 sandbox 属性，确认风险归属宿主；⑤ 官方描述与正文逐条比对，检查夸大；⑥ git HEAD 与任务 pin 比对。",
    "second_pass": [
      {
        "item": "skill 目录资产面（脚本 / references / 数据 / 模板）",
        "status": "ok",
        "detail": "目录实为 3 个文件：SKILL.md 与 example.html、example.md；无 scripts/、无 references 目录、无任何可执行文件（.sh/.py/.js/.mjs/.ts 零命中）。"
      },
      {
        "item": "「无脚本、无网络、无凭证、无写盘」的反例搜索",
        "status": "ok",
        "detail": "对目录递归 token 扫描（api[_-]?key|token|secret|\\.env|process\\.env|child_process|fetch\\(|curl |wget |npm |npx |exec\\(|subprocess|writeFile|fs\\.）：仅命中 example.html 里作为示例文案出现的 \"$ pnpm dlx html-anything\"（展示文本，非可执行指令）；SKILL.md 另按 http|CDN|cdn|font|API|api|fetch|Google|script 扫描，仅命中 font-semibold / font-black 这类字重类名，无端点。"
      },
      {
        "item": "官方描述 vs 实际能力（有无夸大）",
        "status": "ok",
        "detail": "frontmatter description（竖版海报 / 朋友圈分享图, 强视觉冲击）与正文一致：描述承诺的版式要素都能在正文找到对应条目，未见正文未支持的越界承诺。"
      },
      {
        "item": "外部资源/工具条目逐条回源",
        "status": "ok",
        "detail": "external_deps 中的仓库级条目（Tailwind Play CDN / jsdelivr / Google Fonts / 本机 agent CLI）逐条回到 shared.ts 与 argv.ts 原文取证；本模板另有 example.html 的 cdn.tailwindcss.com 外链，已在该 example.html 原文中定位。"
      },
      {
        "item": "宿主执行链（供 security.reason / verdict.risks 使用，不参与判级）",
        "status": "ok",
        "detail": "prompt 经 stdin 送入被 spawn 的本机 CLI（invoke.ts），HTML 从 stdout 分流捕获；claude 参数含 --permission-mode bypassPermissions、envFor 透传 process.env；预览 iframe sandbox=\"allow-scripts allow-same-origin\"（template-picker.tsx:544 / preview-pane.tsx:297）。"
      },
      {
        "item": "路径与 commit 一致性",
        "status": "ok",
        "detail": "工作副本 /var/ytdown/skills-portal/spy-repos/html-anything 的 git HEAD = 553ed98c283f9c0f489902d035416a972d6a9699（与任务表 pin 一致）；skill.path=next/src/lib/templates/skills/poster-hero 下确有 SKILL.md，全仓无第二份同名模板。"
      },
      {
        "item": "example.html 的 Tailwind CDN 外链是否构成运行时外发",
        "status": "ok",
        "detail": "该 <script src=\"https://cdn.tailwindcss.com\"> 位于随包示例产物的 <head>，只在选择器 hover / 预览 iframe 中由浏览器加载，用于渲染这份静态示例本身；skill 目录内无脚本、无网络调用代码，SKILL.md 未要求产物引 CDN。"
      },
      {
        "item": "\"用 SVG 占位\"是否需运行时生成",
        "status": "ok",
        "detail": "原文 \"- 底部右下角放品牌 / 二维码 (用 SVG 占位)\" 指在产物里画一个 SVG 占位图形，由 agent 直接写入 HTML；目录内无二维码生成脚本、无外部接口。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699",
    "sha256": "8eac8d0976c45e65f706c6ec842e944e6ffb4602e0d38c1b552b79d7ced293a7",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/poster-hero.tar.gz",
    "sha256": "8eac8d0976c45e65f706c6ec842e944e6ffb4602e0d38c1b552b79d7ced293a7",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699"
  },
  "original": {
    "github": "https://github.com/nexu-io/html-anything/tree/main/next/src/lib/templates/skills/poster-hero",
    "path": "next/src/lib/templates/skills/poster-hero",
    "commit": "553ed98c283f9c0f489902d035416a972d6a9699"
  }
}