{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "scrapling-skill",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "terms_compliance",
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "SKILL.md / 脚本参数",
      "summary": "Contains bypassing automated detection, disabling host sandboxes, or skipping SSL certificate verification"
    },
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: python3 scripts/diagnose_scrapling.py [--url U] [--selector S] [--dynamic]"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: scrapling CLI initiates HTTP scraping (static get or browser fetch) against arbitrary user-provided URLs; the skill's scripts themselves make no network calls"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: scraping outputs are saved to user-specified paths (examples: page.html / article.md)"
    }
  ],
  "verification": {
    "method": "第二遍独立复核（找茬视角）：①glob 清点目录（含隐藏文件），确认只有 SKILL.md / references/troubleshooting.md / scripts/diagnose_scrapling.py 三个文件；②以 raw 方式整读 192 行诊断脚本，逐函数核对是否存在未声明的网络/凭证/写盘行为；③对全目录做安全 token 终扫（urllib/requests/httpx/socket/eval/exec/os.system/base64/Authorization/token/key/secret/.env/~/）并检查 >200 字符无空格长行（混淆）——零命中；④把 SKILL.md 的每条外部依赖回到具体命令块核对调用点真实存在；⑤把「--no-verify」的全部出现位置找齐（SKILL.md 两处 + troubleshooting.md 一处），确认是否只在文档还是也进了示例命令；⑥git 核对 pin commit、目录内容与历史差异；⑦与仓库内同 pin 下的其他 skill 交叉对照 marketplace 条目。",
    "second_pass": [
      {
        "item": "每条外部依赖的调用点是否真实存在（而非推测）",
        "status": "ok",
        "detail": "六条依赖全部回到原文：scrapling（Step 2 的 uv tool install 'scrapling[shell]'、Step 4 的 scrapling extract …）、uv（同处）、python3（Step 1 的 python3 scripts/diagnose_scrapling.py）、Playwright 运行时（Step 2 的 scrapling install + 诊断脚本的 ms-playwright 缓存探测代码）、mp.weixin.qq.com（Step 4 的公众号示例）、example.com（Step 4 占位示例）。无推测项。"
      },
      {
        "item": "代码层面是否存在被遗漏的网络/凭证行为（找反例）",
        "status": "ok",
        "detail": "反例检索失败：diagnose_scrapling.py 的 import 仅 argparse/shutil/subprocess/sys/tempfile/pathlib/typing；无 urllib/requests/socket；无环境变量或 token 读取（grep os.environ/getenv 零命中）；唯一的网络行为全在被调用的 scrapling CLI 里，本仓库不自带该 CLI。故『脚本自身不发网络请求、不读凭证』成立。"
      },
      {
        "item": "『外部 CLI 才是能力本体』这一实现原理是否夸大——skill 自身是否另有抓取实现",
        "status": "ok",
        "detail": "三文件全部读毕：诊断脚本只做 which/--help/缓存目录探测与一次可选 subprocess 冒烟；troubleshooting.md 全是命令与症状；SKILL.md 全是 SOP。无任何自研抓取/解析代码，原理陈述成立且不夸大。"
      },
      {
        "item": "安全降级（--no-verify）是否只出现在文档说明、未进入可执行示例",
        "status": "discrepancy",
        "detail": "第一遍按上一条思路复核后发现更强的事实：SKILL.md 的『### Diagnose and smoke test a WeChat article body』代码块是把 --no-verify 与 --selector '#js_content' 写在一起的三行命令（python3 scripts/diagnose_scrapling.py \\ --url 'https://mp.weixin.qq.com/s/ARTICLE_ID?scene=1' \\ --selector '#js_content' \\ --no-verify），而诊断脚本确实会把它透传：`if args.no_verify: cmd.append(\"--no-verify\")`。即降级路径不仅被说明、还被脚本实现并示范，不是纯叙述。"
      },
      {
        "item": "references/troubleshooting.md 与 SKILL.md 是否一致",
        "status": "ok",
        "detail": "三档抓取顺序（get → fetch → stealthy-fetch）、--no-verify 的限定条件、浏览器缓存两处路径、微信抓取模式在三档文档中表述一致；troubleshooting.md 额外给出 Contents 与更细的症状清单，属补充而非冲突。"
      },
      {
        "item": "本 pin 下目录内容与历史（含 .security-scan-passed 标记）是否变化",
        "status": "discrepancy",
        "detail": "git diff 63a65c1fccae9f32f7d1e0e99670321ae09d4f53..HEAD -- scrapling-skill/ 显示唯一变化是删除 scrapling-skill/.security-scan-passed（'1 file changed, 4 deletions(-)'），三个实质文件字节未变。该标记文件是 gitleaks 类密钥扫描的通过记录，与本 skill 的能力/风险结论无关，但意味着『曾有过的安全扫描通过标记在当前 pin 已不存在』，引用旧记录时不应再把它算作现状。另：同 pin 的 data/analysis 目录内已有一份本 skill 的旧侦查记录（commit 63a65c1…），本次为按新 pin 的独立重做，结论方向一致（均判红）而证据面按当前 pin 重新采集。"
      },
      {
        "item": "pin commit 与 skill.path 是否与任务书一致",
        "status": "ok",
        "detail": "git rev-parse HEAD = d5c4678cb5d4fd6acc9c922690df035dbd33d247；该目录位于仓库根，相对路径 scrapling-skill；本目录最后实质提交 878f947（2026-09-07）。GitHub API 复核 MIT / stars 1392 / pushed 2026-09-15T09:30:04Z。"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "65c575aca652cc60c9e1facc10acfcef12222a7b22b90980fd0bdadc35a17e18",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/scrapling-skill.tar.gz",
    "sha256": "65c575aca652cc60c9e1facc10acfcef12222a7b22b90980fd0bdadc35a17e18",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/scrapling-skill",
    "path": "scrapling-skill",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}