{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "style-library",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local scripts or commands: (No scripts inside this skill's directory)"
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: Artifact-time references (no runtime outbound requests, excluded from risk rating): Cards/theme CSS reference Google Fonts, fetched by the browser or during localization"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Copying cards to video-projects/<slug>/compositions/ and localizing their CSS/font/GSAP dependencies"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 目录清单核对——find 本 skill 目录只返回 SKILL.md 一个文件（无 scripts/、无 references/、无数据文件），故所有「脚本」都只能来自仓库级路径；② token 扫描（https?:// / process.env / fetch / exec / eval / child_process）在 SKILL.md 内零命中；③ 逐条回查 SKILL.md 指名的非本目录资源是否真实存在：style-library/{GUIDE.md,registry.json,01-vox-explainer,02-kallaway,_blueprint}、style-templates/（含 README.md）、scripts/style-library/{new-style.mjs,build-registry.mjs,gen-kallaway-style.mjs} 均已定位；④ 生成器侧抽查：new-style.mjs / build-registry.mjs 为本地 fs 文件生成脚本；⑤ 双镜像核对：.claude/skills 与 .agents/skills 下本 skill 的 SKILL.md 字节一致（md5 相同）。",
    "second_pass": [
      {
        "item": "SKILL.md 是否真的只有指令、没有夹带脚本或端点",
        "status": "ok",
        "detail": "目录仅 SKILL.md；全文无 http、无 fetch、无 process.env；唯一的命令是本地 node 生成器与 HyperFrames 验证命令。"
      },
      {
        "item": "指名的生成器与库路径是否真实存在（避免文档指向空气）",
        "status": "ok",
        "detail": "style-library/{GUIDE.md,registry.json,01-vox-explainer,02-kallaway,_blueprint}、style-templates/{README.md,left-glass-popout,dark-graph-paper-template}、scripts/style-library/{new-style.mjs,build-registry.mjs,gen-kallaway-style.mjs} 均在工作副本内可定位。"
      },
      {
        "item": "「目录是草稿资源」这一质量声明是否与库内实际状态相符（有没有夸大）",
        "status": "ok",
        "detail": "GUIDE.md 写明 Committed 与 Gitignored 的分界（preview MP4 循环不入库、可由卡片重生），SKILL.md 也明说卡未保证过渲染 QA；两者一致，属诚实标注而非夸大。"
      },
      {
        "item": "卡片是否含硬编码凭证或外部跟踪（供应链面）",
        "status": "unlocatable",
        "detail": "本次只读侦查未逐张打开 style-library/cards/ 下全部卡片 HTML（registry.json 247.7KB，卡数众多）。已确认的第三方面是 Google Fonts 引用（THIRD_PARTY_NOTICES.md 声明）；「每张卡是否只用 tokens.css 变量而无外部脚本」需逐卡审计，本报告不据此下结论。"
      },
      {
        "item": "新增风格流程会不会破坏既有索引",
        "status": "ok",
        "detail": "SKILL.md 要求 manifest 变更后跑 build-registry.mjs，且 GUIDE.md 要求从 _blueprint 克隆而非就地改；索引重写是显式步骤，不存在「手改索引导致漂移」的鼓励。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "0d30152a82b9ceb93cfdd9bdbf46f0d5ab3cde86",
    "sha256": "2463b10b86691d38c56d265606453e2e18a6c223ff68251026a779a7686cc212",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/style-library.tar.gz",
    "sha256": "2463b10b86691d38c56d265606453e2e18a6c223ff68251026a779a7686cc212",
    "commit": "0d30152a82b9ceb93cfdd9bdbf46f0d5ab3cde86"
  },
  "original": {
    "github": "https://github.com/nateherkai/hyperframes-student-kit/tree/main/.claude/skills/style-library",
    "path": ".claude/skills/style-library",
    "commit": "0d30152a82b9ceb93cfdd9bdbf46f0d5ab3cde86"
  }
}