本案例用于验证 verifiable-agent-audit 是否能在其来源项目之外，以只读、可重复的方式建立 Agent 仓库能力清单。扫描对象是 IssueLens，输出写入目标仓库之外。
This case validates whether verifiable-agent-audit can build a read-only, repeatable capability inventory for an Agent repository. The target is IssueLens, and the report is written outside the repository.
python3 skills/verifiable-agent-audit/scripts/audit_agent_repo.py \
--repo ../issuelens-agent \
--out /tmp/issuelens-verifiable-agent-audit.json脚本在扫描前后计算仓库快照；若发生漂移则关闭失败。它限制文件数量、单文件大小和每类命中数量，并拒绝把输出写入被审计仓库。
The script snapshots the repository before and after inspection and fails closed on drift. It bounds file count, per-file size, and findings per category, and refuses to write output inside the audited repository.
- 扫描文件 / Files scanned:
63 - 仓库快照 / Repository snapshot:
935c18ebb4ba0f388ea30ed0881cb071cdc5d1732e29e9328b8fd05725cea574 - 审批线索 / Approval leads:
192 - 检查点线索 / Checkpoint leads:
86 - 文件写入线索 / Filesystem-write leads:
65 - 预算与超时线索 / Budget-and-timeout leads:
62 - 完整性线索 / Integrity leads:
59 - 评测线索 / Evaluation leads:
31 - 进程执行线索 / Process-execution leads:
15 - 网络线索 / Network leads:
11 - 隔离线索 / Isolation leads:
9 - 外部发布线索 / External-publication leads:
1
这些数字是供人工审计继续追踪的模式命中，不是漏洞数量，也不是安全结论。动态配置、运行时行为和外部服务仍需单独检查。
These numbers are pattern matches for follow-up review, not vulnerability counts or security verdicts. Dynamic configuration, runtime behavior, and external services still require separate inspection.
该案例证明 Skill 不只是说明文档：它包含确定性脚本、明确边界、机器可读结果和真实仓库前向验证。面试中可据此说明如何把一次项目经验抽象为可移植的 Agent 工程方法。
This case demonstrates that the Skill is more than documentation: it includes a deterministic script, explicit boundaries, machine-readable output, and forward validation against a real repository. It provides concrete evidence that project experience was abstracted into a portable Agent-engineering method.