{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "to-tickets",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "external_write",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "外部 API",
      "summary": "Executes posts, resource creation, or modification writes to external platforms"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Local mode: `.scratch/<feature-slug>/issues/<NN>-<slug>.md` one file per ticket, numbered in dependency order (combining into a single file is forbidden)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度找第一遍的错），实执行：① 全量清单核对（to-tickets/ 仅 SKILL.md + agents/openai.yaml）；② 对 skill 目录 token 扫描（http/curl/npm/gh/glab/token/secret/env）确认无隐藏命令与端点；③ 与同仓 runcomfy 无关——改为与 setup 模板互证：`gh api …/dependencies/blocked_by`、`issue_dependencies_summary.blocked_by`、`.scratch/…/issues/<NN>-<slug>.md` 三处契约在 setup skill 内逐条复核存在；④ 与 README.md、skills/engineering/README.md、docs/engineering/to-tickets.md 的描述交叉核对，检查夸大；⑤ 用 CHANGELOG 复核 to-issues→to-tickets 的合并与 wide-refactor 能力的归属；⑥ gh api 复核 stars/license/pushed_at。",
    "second_pass": [
      {
        "item": "队列 slug `to-issues` 在 pin commit 是否作为目录存在",
        "status": "discrepancy",
        "detail": "不存在。HEAD 树内无 skills/engineering/to-issues（也无 to-tickets 之外的 to-plan）；CHANGELOG 明写 '`to-plan` and `to-issues` are merged into one `to-tickets` skill, and `to-issues` is deleted.'。本 JSON 以 HEAD 实名 to-tickets 记录，页面 slug 与文件名沿用任务书的 to-issues。"
      },
      {
        "item": "『to-issues 的功能确已并入 to-tickets』是否属实（而非删掉即失去）",
        "status": "ok",
        "detail": "CHANGELOG PR #469 记 to-issues 曾获得 wide-refactor（expand–contract）与 Co-located reference blocks；现行 to-tickets/SKILL.md line 40 完整保留该段（expand/migrate/contract 与集成分支兜底），说明能力是迁移而非丢失。"
      },
      {
        "item": "阻断边的落点是否真由 tracker 文档决定（而非 skill 硬编码路径）",
        "status": "ok",
        "detail": "to-tickets 正文只给形态要求（'Use the platform's native blocking / sub-issue relationship where it has one'）与本地路径约定；具体命令（gh api …/dependencies/blocked_by、gh issue edit --add-assignee 等）与 frontier 查询定义全在 setup-matt-pocock-skills/issue-tracker-github.md 内，两处措辞一致。"
      },
      {
        "item": "『无网络外发』类声明是否成立",
        "status": "ok",
        "detail": "skill 文件 token 扫描无 http/curl/fetch 关键字；网络行为全部经 tracker 文档定义的 gh/glab 间接发生，已按条件性记入 network_calls。"
      },
      {
        "item": "取参 fetch 是否有限制（主机白名单/大小/去指令化）",
        "status": "discrepancy",
        "detail": "定位不到任何限制：SKILL.md 只写 'fetch it and read its full body and comments'，无主机白名单、无大小上限、无 untrusted/防注入条款；对超长 spec 的截断问题反倒在 docs 页被当作环境问题（建议同窗口不要 clear/compact）来描述，说明 skill 层面无防护。此点按「定位不到不硬写」只记事实，不升级档位。"
      },
      {
        "item": "installs / stars 口径",
        "status": "ok",
        "detail": "installs=353800 来自 skills.sh 注册表的旧 slug 记录（queue-100.json 的 to-issues 条目），仓库内无此数值；stars=262519 为 2026-09-15 gh api 实测。口径不同，页面并列时需标注来源。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "3cca18b368ae95cdbdebbff572ccafa662551015",
    "sha256": "0a4d30fcc2a2ce67cec0a7633517936c82ffdea712545ea3da3b4f1f123b6944",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/to-tickets.tar.gz",
    "sha256": "0a4d30fcc2a2ce67cec0a7633517936c82ffdea712545ea3da3b4f1f123b6944",
    "commit": "3cca18b368ae95cdbdebbff572ccafa662551015"
  },
  "original": {
    "github": "https://github.com/mattpocock/skills/tree/main/skills/engineering/to-tickets",
    "path": "skills/engineering/to-tickets",
    "commit": "3cca18b368ae95cdbdebbff572ccafa662551015"
  }
}