{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "repomix-unmixer",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: python3 scripts/unmix_repomix.py <repomix_file> [output_directory] (shipped with repository, standard library only)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Writes files under output_dir after mkdir(parents=True) based on paths specified in repomix file content: full_path = Pat"
    }
  ],
  "verification": {
    "method": "第二遍独立复核（找茬视角，不沿用第一遍结论）：①glob 清点目录全部文件，确认只有 SKILL.md/README.md/references×2/scripts×1，无隐藏脚本、无 .skill 打包物；②重读 unmix_repomix.py 全文 179 行（未用结构摘要），逐函数核对写盘路径来源与是否有任何校验；③对全目录做安全 token 终扫（requests/httpx/urllib/socket/subprocess/eval/exec/os.system/base64/curl/wget/env/token/key/secret）确认零命中，坐实「无网络、无凭证」；④扫描全部文件是否存在 >200 字符无空格的可疑长行（混淆/内嵌二进制）——零命中；⑤把 SKILL.md 的输出示例与脚本 print 语句逐字对照，核对声明与实际一致；⑥把 README.md 的三种格式示例与脚本正则对照，找出文档漂移；⑦git 核对 pin commit 与路径、GitHub API 复核 stars/license/last_push。",
    "second_pass": [
      {
        "item": "「无网络外发、无凭证读取」结论是否有反例（隐藏脚本/混淆内容/间接调用）",
        "status": "ok",
        "detail": "目录内共 5 个文件全部读毕；脚本 import 段仅 re/os/sys/json/pathlib；全目录 token 终扫 urllib/requests/httpx/socket/subprocess/curl/wget/Authorization/token/key/secret/.env 零命中；无长混淆行；无 .skill 打包物需要与仓库比对。结论成立。"
      },
      {
        "item": "「实现原理」是否夸大：声明支持三种格式 vs 代码实际能力",
        "status": "ok",
        "detail": "三种格式各有独立解析函数（unmix_xml/unmix_markdown/unmix_json）且 detect_format 会真的分派，非口头宣称。SKILL.md 的示例输出（✓ Extracted: …／✅ Successfully extracted N files!）与脚本 print 语句逐字一致。无夸大。"
      },
      {
        "item": "README.md 声明的 Markdown 格式与脚本实际正则是否一致",
        "status": "discrepancy",
        "detail": "README「Supported Formats → Markdown Format」给出的是三级标题加四反引号围栏（### File: relative/path/to/file.ext），而脚本正则是 r'## File: ([^\\n]+)\\n```[^\\n]*\\n(.*?)\\n```'（两个 #、三反引号）。'### File:' 不含子串 '## File:'（第三个字符是 # 而非空格），按 README 示例构造的输入会零提取并触发脚本的 '⚠️  No files extracted!' 退出。SKILL.md 与 references/repomix-format.md 的示例是对的（## File:），即漂移只在 README。"
      },
      {
        "item": "README.md 声明的安装方式是否在仓库内可验证",
        "status": "unlocatable",
        "detail": "README 第 1 步要求「Download repomix-unmixer.zip」，但仓库内不存在任何 .zip/.skill 打包物（find 全仓 -name '*.skill' -o -name 'repomix-unmixer.zip' 零命中）。该 zip 是否由外部发布渠道提供，源码内无法定位，记为待补。"
      },
      {
        "item": "README 声明的许可与版本是否与仓库一致",
        "status": "discrepancy",
        "detail": "README 写「This skill follows the same license as Claude Code」且「Version: 1.0.0 / Created: 2025-10-22」，未点名 MIT；仓库根 LICENSE 为 MIT（Copyright (c) 2025 daymade）。属表述含糊（未直接冲突，但 README 未指向仓库根 LICENSE），且 README 未记录任何后续更新日期。"
      },
      {
        "item": "写入路径是否真的无防护（安全结论的关键项，须找反例而非确认）",
        "status": "discrepancy",
        "detail": "反例检索失败→确认无防护：对 unmix_repomix.py grep '..|resolve|is_relative_to|abspath|normpath|startswith|sanitiz|safe' 仅命中无关行（正则里的 '<file path='、'## File:' 与 main() 的 os.path.exists 输入文件检查）。即输出目录内的路径完全未校验，第一遍判断成立并被强化。"
      },
      {
        "item": "pin commit 与 skill.path 是否与任务书一致",
        "status": "ok",
        "detail": "git rev-parse HEAD = d5c4678cb5d4fd6acc9c922690df035dbd33d247；该目录位于仓库根，相对路径 repomix-unmixer；该目录最后一次提交为 878f947（2026-09-07），HEAD 未触及本目录。GitHub API 复核：MIT、stars 1392、pushed 2026-09-15T09:30:04Z。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "e046271700f755d1100810fcd8615f58629f242473bc404c955ec328ca900177",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/repomix-unmixer.tar.gz",
    "sha256": "e046271700f755d1100810fcd8615f58629f242473bc404c955ec328ca900177",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/repomix-unmixer",
    "path": "repomix-unmixer",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}