{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "windows-remote-desktop-connection-doctor",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: python3 scripts/probe_rdp_server.py <host> [port] (bundled in repo; initiates TCP connection + RDP probe to target host)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: TCP connection to user-specified RDP host:3389 (or custom port), sends RDP negotiation packets, and upgrades to TLS"
    }
  ],
  "verification": {
    "method": "第二遍独立复核（找茬视角）：①glob 清点目录（含隐藏）确认资产面为 SKILL.md + references×3 + scripts×1，共 5 个文件；②以 raw 整读 probe_rdp_server.py 全文，逐行核对「无凭据」声明、TLS 校验设置、退出码与实际网络动作；③提取 SKILL.md 与 3 份 reference 中出现的每一个域名/IP/端口并逐条回查调用点，确认无未记载外发目标；④专项目标检索『安全降级』类 token（CERT_NONE/check_hostname/StrictHostKeyChecking/verify=False/--no-verify/shell=True/eval/exec）并逐项判定；⑤检索凭据类 token（password/token/secret/api_key/keychain/getenv）确认无命中；⑥扫描 >200 字符无空格长行与 base64 大块（仅 -EncodedCommand 的合法用例外）；⑦核对 frontmatter 的 allowed-tools 声明与文档实际行为是否一致；⑧git 核对 pin commit 与目录最后一次提交。",
    "second_pass": [
      {
        "item": "探针「无凭据」声明是否有反例（是否真的不读认证材料）",
        "status": "ok",
        "detail": "反例检索失败：probe_rdp_server.py 的 import 为 socket/ssl/struct/sys/typing，无 os.environ/getenv、无 open()、无 keychain 调用；全流程是 create_connection → sendall(19 字节固定握手包) → recv → wrap_socket。凭据类 token 在全目录 grep（password/token/secret/api_key/credential）除文档描述「认证失败」的语义词外零命中。声明成立。"
      },
      {
        "item": "TLS 校验关闭是否为「未交代的松绑」",
        "status": "ok",
        "detail": "已充分交代：代码内注释 'We intentionally disable verification because the diagnostic goal is to confirm the RDP stack accepts TLS, not to validate the certificate chain.'；reference 内有专门引用块说明 'The probe intentionally disables certificate verification... It does not authenticate the server. For a full certificate audit, use a separate TLS inspection tool.'。属有意识、有边界说明的设计，不是隐藏降级。已记入 security.injection_surface 与 grade.reason。"
      },
      {
        "item": "是否漏记外发目标（域名/IP 全量回查）",
        "status": "ok",
        "detail": "提取结果：stun.l.google.com:19302、stun1.l.google.com:19302、rdweb.wvd.microsoft.com、<prefix>-rdgateway-r1.wvd.microsoft.com、*.wvd.microsoft.com（DIRECT 规则示例）、13.104.0.0/14（IP-CIDR 示例）、<local-ip>:8080（ShadowRocket 配置 API）、<host>:3389（用户指定目标）。均已归入 external_deps 的 12 个条目；无未记载的隐蔽外发。"
      },
      {
        "item": "frontmatter 的 allowed-tools 声明与文档行为是否一致",
        "status": "ok",
        "detail": "声明为 `allowed-tools: Read, Grep, Bash`。文档要求的动作是：读日志（Read/grep）、跑 ifconfig/netstat/scutil/lsof/tailscale/ps（Bash）、跑探针与内联 python（Bash）——全部落在声明范围内；且文档不要求写文件（无 chmod/编辑配置/生成文件的步骤，AVD 的 DIRECT 规则是以「给用户的修法」形式给出，由用户在代理工具里配置，而非本 skill 直接改配置）。声明与行为一致，且比同仓库的 tunnel-doctor（含 Edit）更保守。"
      },
      {
        "item": "是否有未实现的宣称（能力 vs 文档）",
        "status": "ok",
        "detail": "逐项抽查成立：承诺「分析传输协议选择」→ 有 Connection Info 字段表与日志 FetchClientOptions/WebRTC 条目；承诺「解析日志找 Shortpath 失败」→ 有日志模式→含义对照表与 GUID 聚合方法；承诺「解决卡在 Configuring remote PC」→ 有 Category E 完整签名集与修复步骤；承诺「检测 VPN/代理干扰」→ 有 198.18.0.x、STUN/TURN routed through VPN 的判据与 DIRECT 规则修法。均有对应实现/流程支撑，未见夸大。"
      },
      {
        "item": "文档内部是否存在自相矛盾（如是否同时建议放宽校验又不建议）",
        "status": "ok",
        "detail": "抽查与 tunnel-doctor 类似的张力点：本 skill 未出现 ssh -o StrictHostKeyChecking=no；唯一放宽是探针的 CERT_NONE，且被解释为「验证服务端接受 TLS」的必需手法并有明确局限说明。未发现未消解的内部矛盾。"
      },
      {
        "item": "pin commit 与 skill.path 是否与任务书表格一致",
        "status": "ok",
        "detail": "git rev-parse HEAD = d5c4678cb5d4fd6acc9c922690df035dbd33d247，与任务书表格『库内 HEAD』逐字一致；目录位于仓库根，相对路径 windows-remote-desktop-connection-doctor；本目录最后一次提交 878f947（2026-09-07）。GitHub API 复核 MIT / stars 1392 / pushed 2026-09-15T09:30:04Z。"
      },
      {
        "item": "evidence 逐字性是否经磁盘级复核",
        "status": "ok",
        "detail": "【evidence 逐字性校正】首稿该条 quote 把源码第 152 行的 grep 模板截断且过度转义（把 `\\|` 写成 `\\\\|`），导致未与源文逐字匹配；已改为源码中的真实前缀（截到 `\"$LATEST_LOG\"` 为止，避开后续含反斜杠的 `grep -v` 段）。该 grep 模板确实存在，结论未变，属引用精度问题。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247",
    "sha256": "c5c2e8a79a426da5e519a90476245295ed98a668b7be5c707b7c79f4bcdbb6b0",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/windows-remote-desktop-connection-doctor.tar.gz",
    "sha256": "c5c2e8a79a426da5e519a90476245295ed98a668b7be5c707b7c79f4bcdbb6b0",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/windows-remote-desktop-connection-doctor",
    "path": "windows-remote-desktop-connection-doctor",
    "commit": "d5c4678cb5d4fd6acc9c922690df035dbd33d247"
  }
}