{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "qiaomu-cut",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: node scripts/qcut.js <subcommand> (doctor / setup / plan / render / verify / explai"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: scripts/adapters/clipseek.js: fetch(url, …) queries ClipSeek free asset API"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Project internal sources of truth: timeline.json, production-spec.json, explainer-plan.json, narration-ti"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 bundle（§0 核定值 → §1 最大 60/111 文件清单 → §2 逐字内文 → §3 风险扫描 → §4 判级口径）并换角度反查：① 引用路径核对（SKILL.md / README.md / scripts/*.js / references/* 均相对仓库根存在）；② 逐条 quote 回 §2 内文比对，含中文全角引号与省略式拼法；③ 风险扫描复核（URL 57 条、凭证 473 条、外部程序 404 条、写盘 309 条、网络请求仅 3 条命中、危险旗标 3 条为 setup 相关、沙箱 0 条）；④ 判级自证橙档（凭据读取 + 素材出网两条均命中）并与站内 videocut-skills 等同类对照；⑤ meta 复核（commit 与 audit 一致，installs 维持 null）。",
    "second_pass": [
      {
        "item": "网络请求面很小：扫描仅 3 条命中，其中 2 条为真实出网位置",
        "status": "ok",
        "detail": "命中为 CONTRIBUTING.md 的措辞、scripts/adapters/clipseek.js:64 `return fetch(url, {`、scripts/fetch_generated.js:125 `const request = https.get(parsed, {`；与「远端生成物先捕获到项目私有目录再下载」的正文一致。"
      },
      {
        "item": "凭证面巨大（473 条）但绝大多数是文档措辞与 .env 规则，真实凭据读取集中在 ListenHub 与本机授权文件",
        "status": "ok",
        "detail": "代表性命中：.gitignore 的 .env 规则、CONTRIBUTING.md 的 credential-redaction 要求；正文另有 LISTENHUB_API_KEY / credential store / .qiaocut-local-preferences.json 的显式说明，判橙的第①条依据成立。"
      },
      {
        "item": "「缺什么就装什么」与 sudo 使用属实且受控",
        "status": "ok",
        "detail": "危险旗标 3 条命中分别为 SKILL.md:116 的 doctor 安装指引、scripts/setup_deps.js:46 的非 root 加 `sudo -n`、:193 的安装失败提示；与正文「只有安装本身失败时才报告 blocker」一致，无绕过防护行为。"
      },
      {
        "item": "付费安全设计有独立授权文件与测试断言，不是口头承诺",
        "status": "ok",
        "detail": "SKILL.md 有「持续积分授权」整节，并规定测试/smoke 必须用 QIAOMU_CUT_LOCAL_PREFERENCES 指向不存在路径断言默认阻断；.gitignore 第 8 行列出 .qiaocut-local-preferences.json，且公开 skill 不预置。"
      },
      {
        "item": "vendor 快照的指令面已被显式封禁",
        "status": "ok",
        "detail": "§1 列出 vendor/marswaveai-skills 完整上游快照；SKILL.md 素材源边界一节明写嵌套 SKILL.md 不得自动激活，并点名禁止 cola-avatar-pack 的 agent-memory/主目录写入/删除指令——injection_surface 据此收窄。"
      },
      {
        "item": "判级取样：与站内 videocut-skills（orange）、talking-head-recut（blue）对照后取橙",
        "status": "ok",
        "detail": "本 skill 明确读 LISTENHUB_API_KEY 并把本地素材上传到外部生成服务（另加付费裁片），比纯本地剪辑的 blue 档更重，且无 red 特征，故取 orange。"
      },
      {
        "item": "meta 核定值核对：commit=185c59e3…、license MIT、installs=null",
        "status": "ok",
        "detail": "commit 与骨架 audit.skill_commit 相同；README 无 per-skill 安装量可定位值（只有 npx skills add 命令与仓库级徽标），故 stars/last_push/installs 维持 null。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "185c59e3626e45b08bdeddd6bfc0cfaf09a87c6a",
    "sha256": "78c5d565da0421a0808366280411d8b916c166f016c0feb0dd79099f2651cf01",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/qiaomu-cut.tar.gz",
    "sha256": "78c5d565da0421a0808366280411d8b916c166f016c0feb0dd79099f2651cf01",
    "commit": "185c59e3626e45b08bdeddd6bfc0cfaf09a87c6a"
  },
  "original": {
    "github": "https://github.com/joeseesun/qiaomu-cut-skill",
    "path": "",
    "commit": "185c59e3626e45b08bdeddd6bfc0cfaf09a87c6a"
  }
}