feat: add Fact-Check-X multi-platform verification skill - #1049
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9aef2df258
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "node_modules/zod": { | ||
| "version": "3.25.76", | ||
| "resolved": "https://registry.npmmirror.com/zod/-/zod-3.25.76.tgz", |
There was a problem hiding this comment.
In environments where registry.npmmirror.com is blocked, the documented first-run install cannot fetch this runtime: I reproduced npm ci --ignore-scripts --registry=https://registry.npmjs.org with npm 11 and it still requested the lockfile's https://registry.npmmirror.com/zod/-/zod-3.25.76.tgz, failing with 403. Because the skill depends on this package before browser capture can run, regenerate the lockfile against the public npm registry or avoid hard-pinning mirror tarball URLs.
Useful? React with 👍 / 👎.
| const snippet = reference.snippet | ||
| ? `<details class="ref-snippet"><summary>查看摘录</summary><p>${escapeHtml(reference.snippet)}</p></details>` | ||
| : ""; | ||
| return `<li id="${referenceId(platform.platform, reference)}">${marker}${sourceBadge}${attribution}${scope}<a href="${escapeAttribute(reference.url)}">${escapeHtml(title)}</a>${originLink}${platformLink}${snippet}</li>`; |
There was a problem hiding this comment.
When a captured page exposes a non-http(s) link such as javascript:..., the reference schema only requires a nonempty string and normalizeUrl preserves that scheme, so this renderer writes the untrusted URL directly into the local report. Users are instructed to open and click these evidence reports, which can turn captured platform/source content into executable report HTML; restrict report links to safe schemes or render unsafe URLs as text.
AGENTS.md reference: AGENTS.md:L52-L54
Useful? React with 👍 / 👎.
2 participants
Summary
Adds the official Fact-Check-X skill under
skills/fact-check-x-complete/as a complete 94-file runtime. It captures AI answers, citations, screenshots, and HTML evidence; compares atomic claims across selected platforms; optionally verifies claims with trusted search; and produces four traceable stage reports.Supported web platforms are DKnowC, DKnowC Deep Research, Doubao, Tencent Yuanbao, DeepSeek, and Qwen. The selected set remains dynamic (
N >= 1).Source and distribution integrity
LICENSE,NOTICE, andTHIRD_PARTY_NOTICES.md.SKILL.mdfile contents are byte-identical to the official skill directory.When to Use/Limitationsheadings, and rewrites three placeholder Markdown-link examples as equivalent prose so the exact evidence audit reports no dangling links.100644; scripts are invoked through explicit Python or Node interpreters.Risk and safety
Declared
risk: criticalbecause the workflow drives authenticated browser sessions, writes evidence artifacts, and can configure a trusted-search credential after explicit user login. Login, CAPTCHA, and verification remain human-controlled. Platform capture failures stop the pipeline before later stages.Validation
npm run chainnpm run validate:referencesnpm run security:docsnpm run check:warning-budgetnpm test— 104 test files passedpython skills/fact-check-x-complete/scripts/fact_check_x.py locatenpm run check:readme-credits -- --base origin/main --head HEADnpm run pr:evidence -- --base origin/main --head HEAD ...—blocking=false, audit errors 0, security errors 0, warnings 0, unsafe entries 0Change Classification
Quality Bar Checklist
docs/contributors/quality-bar.mdanddocs/contributors/security-guardrails.md.npm run validate.criticaland reviewed against browser, credential, and filesystem behavior.When to Usesection.Limitationssection.npm run security:docsand changed-skill evidence both pass.