{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "session-story",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: sh scripts/setup.sh (one-time npm ci downloading pinned dependencies read-only)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: No outbound calls during build (SKILL.md: Network at build time: none)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact generation: session-story-candidates.json (harvest output containing verbatim user messages)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + token 反查：① grep process.env / fetch( / https?:// / API_KEY|TOKEN|SECRET / curl / child_process|execFile|spawnSync / writeFile，命中逐条打开确认归属；② 逐个打开 scripts/ 下入口（harvest.py、new-project.mjs、schedule.mjs、setup.sh、score/build.sh）核对其调用点真实存在；③ 核对 engine/index.html 的脚本来源（本地 assets/vendor/p5.min.js，无 CDN）以判断渲染是否需要联网；④ 反查文档声明的门禁（DRAFT/approved、ok: no dead air、示例保护、room 校验、失败路径）在源码里是否真有实现。",
    "second_pass": [
      {
        "item": "『No credentials』与『Network at build time: none』是否成立",
        "status": "ok",
        "detail": "目录内 process.env 命中只有 SOUNDFONT（build.sh 交给 fluidsynth 的音色库路径）与 GEMINI_API_KEY 的**提示文本**；无键值读取、无 fetch。engine/index.html 引用 assets/vendor/p5.min.js（本地），渲染链路不需联网。"
      },
      {
        "item": "harvest 的敏感 flag 能否替代人工审核",
        "status": "discrepancy",
        "detail": "不能，文档自己说明了：FLAGS 是正则模式匹配（secret/email/path/url/number/name?/person?），sources.md 明写 'The flags miss what they can't see: a name typed in lowercase (\"like peter said\") has no flag.'。故能力清单不写成『自动脱敏』，隐私门本质是人读。"
      },
      {
        "item": "示例故事冒充是否真会被拦",
        "status": "ok",
        "detail": "schedule.mjs 读取随包 assets/example/story.json，用 quotes() 归一化小写比对引用；命中 ≥2 条且未加 --example 时 exit 1 并提示写自己用户的故事。防糊弄逻辑真实存在。"
      },
      {
        "item": "配乐链是否真有三平台分支与母带门禁",
        "status": "ok",
        "detail": "build.sh 依序判断：Darwin + 系统 gs_instruments.dls + swift → swift 渲染；否则 fluidsynth + SOUNDFONT → 渲染；都不满足则报错退出（并明说两者都不下载东西）。母带为 ffmpeg loudnorm=I=-16:TP=-1.5:LRA=14 + 首尾淡入淡出，最后 python3 qc.py 检响度与死气。"
      },
      {
        "item": "引擎代码来源是否交代",
        "status": "ok",
        "detail": "assets/engine/NOTICE.md 写明 kit/core.js、kit/clawd.js、kit/timeline.js 改编自 ClaudeAnimationBase（commit b1d7e89，MIT），并随包分发 LICENSE-ClaudeAnimationBase；非自有代码有交代。"
      },
      {
        "item": "『40 到 70 s 抓得住注意力』的时长论断",
        "status": "unlocatable",
        "detail": "该区间是设计声明（schedule.mjs 仅对 >80s 打 warning），源码内无实测依据；本次只读侦查未运行 harvest 与渲染，故不作为已核事实使用。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb",
    "sha256": "0e83cbb985854ae81a5d14c292361f3445ecd68f01f2985e6c844b8481e39110",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/session-story.tar.gz",
    "sha256": "0e83cbb985854ae81a5d14c292361f3445ecd68f01f2985e6c844b8481e39110",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes-community-skills/tree/main/skills/session-story",
    "path": "skills/session-story",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  }
}