{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "soundtrack",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: node scripts/sync-check.mjs piece.mp4 [--cues-file piece.cues.json] [--tol "
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: https://openrouter.ai/api/v1/chat/completions — AI music branch only (when explicitly requested by the user), Authori"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Assets and intermediate artifacts: bgm.mp3 (curl streaming audio written to disk), piece_music.mp4 (ffmpeg muxed output)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 全量文件清单核对（skills/soundtrack 下只有 SKILL.md、references/ai-music.md、scripts/sync-check.mjs、templates/groove.js、templates/score.js）；② token 扫描（URL / Authorization / process.env / child_process / writeFile / API_KEY|TOKEN|SECRET / openrouter）逐条回源，确认凭证与端点的唯一出现位置；③ 反向验证能力声明：模板是否真读 BPM/SECTIONS/EVENTS、sync-check 的判据（±100ms、+6dB）是否真在代码里、exit code 语义是否匹配；④ 档位反证：找是否有比橙更高的行为（沙箱/绕过/TLS），以及是否存在「默认路径就读凭证」的误判可能；⑤ 与同仓 javascript-animation 交叉比对（后者 blue），确认差异只来自 ai-music.md 这条支路。",
    "second_pass": [
      {
        "item": "$OPENROUTER_API_KEY 是否真的被读取并外发（橙档判定关键）",
        "status": "ok",
        "detail": "references/ai-music.md 原文给出 `curl -s -N https://openrouter.ai/api/v1/chat/completions -H \"Authorization: Bearer $OPENROUTER_API_KEY\" …`，且开头写明 'Needs an API key.'；端点与凭证同处一条可复制命令，调用点真实存在。"
      },
      {
        "item": "该支路是否真的是「可选、非默认」（避免过度判级）",
        "status": "ok",
        "detail": "SKILL.md 正文写 'Don't ask the user to choose a music source up front.'，并把 AI 音乐放在 '## Other sources (only when asked)' 段下；默认段标题为 '## Default: synthesize it in the page (no key, no files)'。触发条件为用户显式要求。"
      },
      {
        "item": "sync-check 的判据是否与文档一致（能力声明可信度）",
        "status": "ok",
        "detail": "代码内 TOL = Number(opt('--tol', 100)) / 1000 对应 ±100ms；`const jump = 20 * Math.log10(rms(v.t, v.t + .3) / ref), startle = jump > 6;` 对应 +6 dB；无音轨时 console.error 并 process.exit(1)；与 SKILL.md 逐条吻合，无夸大。"
      },
      {
        "item": "模板是否真的与画面共享数据（而非各自维护时间）",
        "status": "ok",
        "detail": "groove.js 头注释给出 schema（sections/events/kit/harmony/key）并写 'The picture reads the same BPM / SECTIONS / EVENTS, so sound and image can't drift apart.'；score.js 同样由 cues（即 window.CUES）切段并做小节取整。声明与实现一致。"
      },
      {
        "item": "是否有比橙更高的行为（红档特征）",
        "status": "ok",
        "detail": "全仓扫描 `sandbox|automationcontrolled|no-verify|stealth|bypass|ignoreHTTPSErrors|dangerously` 零命中；curl 未使用 -k/--insecure，无绕防护动作，无任意代码执行面（模板是页面内 Web Audio 代码）。"
      },
      {
        "item": "确定性声明（每次渲染一致）是否可在模板代码内定位",
        "status": "ok",
        "detail": "score.js 的混响脉冲用固定种子 LCG 生成并注释 'deterministic noise tail (seeded, so every render is identical)'；groove.js 同样用 `let s = 99 + c` 起手的 LCG 与固定种子噪声缓冲。声明属实。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f",
    "sha256": "7cd2fd4b7c5af0a25bc4b652e72b7a4ca5abf19b684260f03db70a43d46a8f51",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/soundtrack.tar.gz",
    "sha256": "7cd2fd4b7c5af0a25bc4b652e72b7a4ca5abf19b684260f03db70a43d46a8f51",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f"
  },
  "original": {
    "github": "https://github.com/iart-ai/javascript-animation-skills/tree/main/skills/soundtrack",
    "path": "skills/soundtrack",
    "commit": "deb46e0eff8dece768d6cde20b2eed6c22526e5f"
  }
}