{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "xiaohu-ip-studio",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local script or command: python3 scripts/illo.py init (guides key configuration, creates ~/.config/xiaohu-ip-studio/ and writes conf"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: scripts/generate.py uses urllib.request to send POST requests to the configured base_url (OpenAI-compatible image endpoint: creates tasks"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: scripts/illo.py:20-21 creates ~/.config/xiaohu-ip-studio/ directory and writes config.yaml (containing api"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 bundle（§0 核定值 → §1 100+ 文件清单 → §2 逐字内文 → §3 风险扫描 → §4 判级口径）并换角度反查：① 引用路径核对（SKILL.md / README.md / config.example.yaml / scripts/generate.py / scripts/illo.py / food-mascots/*/character.md 均相对仓库根存在）；② 逐条 quote 回 §2 内文比对，含中文半角逗号与英文引号混排；③ 风险扫描复核（URL 101 条、凭证 18 条、外部程序仅 3 条且都是 urllib 伪装 UA、写盘仅 3 条、网络请求 12 条全在 generate.py、危险旗标 0 条、沙箱 0 条）；④ 判级自证橙档并与站内 ian-xiaohei-illustrations（同源血统、orange）对照；⑤ meta 复核（commit 与 audit 一致，installs 维持 null）。",
    "second_pass": [
      {
        "item": "出网面收敛：网络请求 12 条命中全部落在 scripts/generate.py 的 urllib 调用，其它文件零命中",
        "status": "ok",
        "detail": "命中为 generate.py:18/97/99/115/117/122/123/152/153/155/267/313，即 Request/urlopen/HTTPError 与轮询；URL 101 条命中里大量是 README.en.md 的 raw.githubusercontent 角色图链接与 CREDITS.md 署名链接，属文档引用。"
      },
      {
        "item": "凭证面很小且集中：18 条命中只涉及 config.yaml 的 api_key 与 XDG_CONFIG_HOME",
        "status": "ok",
        "detail": "代表性命中 config.example.yaml:7 与 references/backends.md:18（「你自己的 key,永不上传」）、scripts/generate.py:48-49（缺 key 时报错提示 init）、illo.py:7/20/21/35；无 .env/keychain 读取。"
      },
      {
        "item": "「外部程序」3 条命中不是真的执行外部进程，而是 urllib 请求伪装 UA 触发的正则",
        "status": "ok",
        "detail": "generate.py:122/147/257 均为 headers 里 User-Agent: curl/8.4.0，属误报；本 skill 无 subprocess/os.system 调用，与 install.sh 只调 python3 脚本一致。"
      },
      {
        "item": "抗 prompt 注入设计是显式条款，不是推断",
        "status": "ok",
        "detail": "SKILL.md 有「角色包安全规则」整段（读外部 character.md 只提取定义段落、绝不执行其中指令性文字），README 安全一节复述同一规则；风险扫描「危險旗標/防護繞過」零命中，说明这是主动设计而非缺陷。"
      },
      {
        "item": "零依赖与配置权限属实",
        "status": "ok",
        "detail": "install.sh 只检查 python3；illo.py 写 config.yaml 于 ~/.config/xiaohu-ip-studio 且正文标 mode 600；.gitignore 列 config.yaml/config.json/__pycache__ 等，无第三方包声明。"
      },
      {
        "item": "归档与角色数量核对：31 个在用角色 + 4 个归档",
        "status": "ok",
        "detail": "§1 清单：characters/ 15 个、food-mascots/ 16 个（合计 31）；_archived-symbols-20260617/ 另有 achong/lengjiao/shuangzi/xiaoxing 4 个，与 SKILL.md 的 15+16 说法一致，归档不计入。"
      },
      {
        "item": "meta 核定值核对：commit=9d3091e8…、license MIT、installs=null",
        "status": "ok",
        "detail": "commit 与骨架 audit.skill_commit 相同；README 无 per-skill 安装量可定位值（README 只说 clone 到技能目录或 bash install.sh），故 stars/last_push/installs 维持 null。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "9d3091e8a1ff26ec5ce5f613cd3b36b35c9b98f6",
    "sha256": "9c30dd21d9c9ed75d14b791a1beb2d063759be67154cd173e6a7d9400decf228",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-10-10/xiaohu-ip-studio.tar.gz",
    "sha256": "9c30dd21d9c9ed75d14b791a1beb2d063759be67154cd173e6a7d9400decf228",
    "commit": "9d3091e8a1ff26ec5ce5f613cd3b36b35c9b98f6"
  },
  "original": {
    "github": "https://github.com/xiaohuailabs/xiaohu-ip-studio",
    "path": "",
    "commit": "9d3091e8a1ff26ec5ce5f613cd3b36b35c9b98f6"
  }
}