{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "prod-by-claude",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: node scripts/new-project.mjs <dir> (pure local file copying: template + track + 4 tools files)"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: npm install (npm registry; dependency versions pinned by tools/package.json)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Strictly confined to <project-dir>: data/events.json, data/events.js, assets/bgm.wav, assets/st"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + token 反查：① grep 扫四个目录的 process.env / fetch( / https?:// / API_KEY|TOKEN|SECRET / curl / child_process|execFile|spawnSync / writeFile，命中逐条打开确认归属；② 逐个打开 scripts/ 下四个文件，确认调用点真实存在（不是文档推测）；③ 核对模板与录音页的脚本来源（本地 node_modules vs 远端 CDN），据此区分『执行期外发』与『产物期引用』；④ 反查文档质量门禁（-2 dBFS 削波门、snapshot 时刻、云渲染额度）在实现或副作用声明里是否有对应。",
    "second_pass": [
      {
        "item": "『No credentials.』声明是否成立",
        "status": "ok",
        "detail": "SKILL.md Rights/Side effects 段明写 'No credentials.'；目录内 process.env 命中只有 record.mjs 的 CHROME 与 CFG 类入参，未见 key/token/cookie/keychain 读取，也无 .env 解析。"
      },
      {
        "item": "『录音离线』是否等于全流程离线",
        "status": "discrepancy",
        "detail": "录音段确实离线（127.0.0.1 静态服务 + 本地无头 Chrome + node_modules 里的 @strudel/web；recorder.html 注释明写 nothing is fetched from strudel.cc），但建仓（npm install、Chrome for Testing 下载）与渲染期构图载入 GSAP（cdn.jsdelivr.net）都要联网。SKILL.md 自己把这些写进 Side effects，故非隐瞒；只是『离线』的适用范围仅限录音。据此把档位定为蓝（官方源固定版本安装 + 产物期 CDN，与同 repo 先例 hyperframes-animation / hyperframes-core 同口径）。"
      },
      {
        "item": "高亮是否真由音符事件驱动（而非后期对齐）",
        "status": "ok",
        "detail": "链路可读通：record.mjs 导出每音符的 locs（代码字符区间）→ build-data.mjs 用 byLoc 汇总成 token 时间表与段落/widget 时间 → 写成 window.SQ → 模板 app.js 消费。音画同源成立，不是后期对轨。"
      },
      {
        "item": "是否误把 ffmpeg 列为依赖",
        "status": "discrepancy",
        "detail": "本 skill 目录内不调用 ffmpeg：录音与 mix 走 Strudel 的离线渲染器，编码由 HyperFrames CLI 负责。故 external_deps 不列 ffmpeg（同批姊妹 skill 有列，本 skill 没有）。"
      },
      {
        "item": "大写 S 标签的拒绝逻辑是否真在代码里",
        "status": "ok",
        "detail": "record.mjs 实有 'const soloing = labels.filter((l) => l.length > 1 && l.startsWith(\"S\"));' 并在命中时 fail 提示改名——不是文档空话。"
      },
      {
        "item": "录制耗时与云渲染额度的具体数值",
        "status": "unlocatable",
        "detail": "『约 5-7 分钟/32 小节』与云渲染『消耗多少额度』只有文档声明，源码内无可复现依据；本次为只读侦查，未运行录音或渲染，故不作为已核事实使用。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb",
    "sha256": "90eabb744789abe6719828293e23de0a3ae20c1dd5960895b5356fb323af257d",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/prod-by-claude.tar.gz",
    "sha256": "90eabb744789abe6719828293e23de0a3ae20c1dd5960895b5356fb323af257d",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes-community-skills/tree/main/skills/prod-by-claude",
    "path": "skills/prod-by-claude",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  }
}