{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "x-posting-license",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: node <SKILL_DIR>/scripts/build.mjs --out <dir> --name … --handle … --joined"
    },
    {
      "file": "网络端点",
      "summary": "Declared external network access: https://x.com/<handle> (logged-out profile page for agent-side data scraping)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Inside --out directory: index.html, assets/avatar.jpg, hyperframes.json, meta.json, and render output"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + token 反查：① grep process.env / fetch( / https?:// / API_KEY|TOKEN|SECRET / curl / child_process|execFile|spawnSync / writeFile 覆盖本目录，命中逐条打开确认归属（本目录命中只有模板的 jsDelivr GSAP、SKILL.md 与 profile-data.md 的端点与 curl 示例、build.mjs 的写盘）；② 通读 build.mjs 的校验与写盘段，确认『转义/校验/symlink 拒绝/残留 token 检查』不是文档空话；③ 打开模板核对 {{TOKEN}} 集合与 build.mjs 的 fill 键是否一一对应，并确认时间轴确实是固定 data-duration 与 window.__timelines 注册；④ 反查『不许编数据』『不许手改模板』两条纪律在文档中的位置。",
    "second_pass": [
      {
        "item": "『do NOT edit the timeline』是否与模板事实一致",
        "status": "ok",
        "detail": "#root 上写死 data-duration=\"10.35\"、data-fps=\"60\"、data-composition-id=\"x-license\"，时间线注册在 window.__timelines[\"x-license\"]；build.mjs 只做 token 替换，不触碰任何时间属性。模板确实锁死，agent 的改动面只有数据。"
      },
      {
        "item": "模板 token 与 build.mjs 的 fill 键是否一一对应",
        "status": "ok",
        "detail": "fill 提供 NAME_BIG、NAME_SIG、HANDLE_UPPER、JOINED、ISS、FOLLOWERS、FOLLOWING、POSTS、FOLLOWERS_FMT、BIO_UPPER；模板中出现的 {{…}} 均在其中（FOLLOWERS_FMT 用于背面 fine print），且替换后有 unfilled token 检查兜底。"
      },
      {
        "item": "『profile 数据是不可信输入』的处理是否真存在",
        "status": "ok",
        "detail": "cleanText（去控制字符 + 限长）、cleanCount（只收纯非负整数，显式拒绝符号/小数/指数/NaN/逗号）、handle 正则 ^[A-Za-z0-9_]{1,15}$、joined 走 MONTHS 枚举、esc() 逐字符转义、refuseSymlink() + safePath() 限定写入在 out 实路径内——逐条在源码可验。"
      },
      {
        "item": "端点是否都可预期、是否真的无凭证",
        "status": "ok",
        "detail": "SKILL.md 的 Network and side effects 列表与 references/profile-data.md、模板引用一一对应；无 API key、无 cookie 读取、无 telemetry；fxtwitter 免认证且文档给了降级路径（不可用时问用户）。"
      },
      {
        "item": "『Rendering is NOT fully offline』是否属实",
        "status": "ok",
        "detail": "模板 <head> 第 6 行就有 jsDelivr 的 gsap@3.14.2 引用，preview/render 时构图会去取——与文档声明一致，不是夸大也不隐瞒。"
      },
      {
        "item": "10.35s 与 flip ~6.5s / leap ~9.9s 的时刻声明",
        "status": "unlocatable",
        "detail": "这些时刻来自文档叙述与模板属性，本次只读侦查未渲染核对；且文档用的是 @latest 的 CLI（版本未固定），故这些时刻只对该 pin commit 的模板有效，不作为已核事实。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb",
    "sha256": "6e227bb6839e972c1ced34806ca50cb0aa5fb611f85fa10e874190c2f8bb924d",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-28/x-posting-license.tar.gz",
    "sha256": "6e227bb6839e972c1ced34806ca50cb0aa5fb611f85fa10e874190c2f8bb924d",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  },
  "original": {
    "github": "https://github.com/heygen-com/hyperframes-community-skills/tree/main/skills/x-posting-license",
    "path": "skills/x-posting-license",
    "commit": "ba7a0bb6d3567d124c51f6074625043bfe0b32eb"
  }
}