Habilidades dbs-skill-maker

📦

dbs-skill-maker

Name: dbs-skill-maker
Author: dontbesilent2025

Revisión del contenido r1 Riesgo medio ⚙️ Comandos externos📁 Acceso al sistema de archivos

Build and Validate Reusable Agent Skills

Recurring tasks often lack clear boundaries, reusable instructions, and reliable acceptance tests. This skill turns those tasks into focused agent skills with structured validation and optional GitHub delivery.

Compatible con: Claude Codex Code(CC)

⚠️ 50 Deficiente

Maintain this Skill? Claim it ⚠️ 50 Deficiente

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "dbs-skill-maker" from https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-skill-maker/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/dontbesilent2025-dbs-skill-maker.md Manifest firmado GET /api/skills/dontbesilent2025-dbs-skill-maker/manifest Lockfile firmado GET /api/skills/dontbesilent2025-dbs-skill-maker/lockfile

Pruébalo

Usando "dbs-skill-maker". Create a local skill that turns approved incident notes into a customer update.

Resultado esperado:

Candidate: incident-update, with task instructions and interface metadata.
Boundary: use approved notes only; stop when customer impact is unknown.
Validation: structural checks passed; behavior remains unverified.
Delivery: local files only; no remote repository created.

Usando "dbs-skill-maker". Review a candidate that produces inconsistent release summaries.

Resultado esperado:

Observed failure: the candidate includes changes outside the requested release.
Proposed change: require an explicit release boundary before selecting changes.
Evaluation plan: compare baseline and candidate on normal, boundary, negative, and held-out cases.
Status: improvement remains unproven until actual outputs pass the evaluation.

Usando "dbs-skill-maker". Prepare this reviewed skill for sharing without publishing it yet.

Resultado esperado:

Prepared local repository staging with a README and runtime skill resources.
Compared staged files with the source and excluded evaluation records.
Remote creation, pushing, tags, releases, and external installation verification remain pending authorization.

Auditoría de seguridad

Riesgo medio

v1 • 17/10/2026 Abrir el informe versionado

Most alerts are Markdown formatting, readable Chinese documentation, or bounded syntax checks; no evidence found of encrypted payloads or audit manipulation. Repository preparation trusts the frontmatter name, allowing file copies outside staging and possible overwrites. Additional concerns involve unsandboxed installation verification and instructions recommending an entire external skill collection globally.

Archivos escaneados

1,262

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Medio

scripts/verify_npx_install.sh:12-14 scripts/verify_npx_install.sh:36-38 references/github-publishing.md:81-87

Installation Verification Is Not Sandboxed

Documentation calls verification isolated, but the script only changes HOME before executing an unpinned npm installer. Host permissions and other environment variables remain available.

The installer invocation overrides HOME only and specifies no package version. A temporary home directory does not restrict filesystem access, process privileges, or inherited credentials.

Medio

SKILL.md:153-159

Broad External Skill Installation Prerequisite

Local delivery directs users to install the author's entire skill collection globally with --all. This expands persistent agent instructions beyond the requested skill or helper.

The workflow explicitly requires installing dbskill before continuing and supplies a global --all command. No evidence found that every included skill is necessary or separately reviewed.

Elementos de revisión de capacidades (1)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

scripts/prepare_github_repo.py:44

Python shutil operations

shutil.copy2(source, destination)

The frontmatter name reaches target_skill without validation at lines 129-140. Absolute or traversal names redirect copy2 outside staging and can overwrite existing files.

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-skill-maker/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-skill-maker/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-skill-maker.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

dontbesilent2025. (2026). dbs-skill-maker security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker/audits/1

Cita BibTeX

@techreport{dontbesilent2025-dontbesilent2025-dbs-skill-maker-2026,
  author = {dontbesilent2025},
  title = {dbs-skill-maker security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-skill-maker security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-skill-maker/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-skill-maker:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Standardize a Repeated Development Task

Turn a recurring code-review preparation task into one skill with clear inputs, exclusions, and observable completion checks.

Formalize a Team Workflow

Convert recurring operational questions into a reusable skill with explicit decisions, required evidence, and permission boundaries.

Evaluate an Existing Skill

Assess a candidate against normal, boundary, negative, and held-out cases before choosing a minimal improvement and running regression checks.

Prueba estos prompts

Beginner: Define a Skill

Use dbs-skill-maker to turn my recurring meeting-summary task into one skill. Define its inputs, outputs, boundaries, and observable completion criteria.

Intermediate: Generate Local Files

Create a local release-notes skill from these requirements and examples. Generate real files, run structural checks, and report unverified behavior. Do not publish or install dependencies.

Advanced: Evaluate and Improve

Evaluate this candidate skill using normal, boundary, negative, and held-out cases. Keep expected answers hidden from execution. Propose one minimal change and check regressions.

Expert: Prepare Controlled Delivery

Prepare a local GitHub staging directory for this reviewed skill. Validate destination containment and inspect public files. Request approval before remote writes or external installation checks.

Mejores prácticas

Define observable success, excluded tasks, and permission boundaries before generating files.
Keep expected answers separate from execution and report only the validation level supported by actual evidence.
Review destination paths and public files, and approve external installation or remote writes separately.

Evitar

Treating structural validation as proof of behavioral quality or comprehensive security.
Publishing private examples, expected answers, credentials, or unrelated staged files.
Running unreviewed global collection installs or assuming a temporary HOME provides a security sandbox.

Preguntas frecuentes

What does this skill produce?

It creates one focused skill directory with instructions and optional supporting resources, then guides validation and local delivery.

Can I use it with Claude, Codex, or Claude Code?

The workflow targets agent clients that support skills. Bundled Python and Bash helpers also require compatible local runtimes.

Does it publish to GitHub automatically?

No. Publication is optional, and remote repository creation, pushing, tags, and releases require explicit user authorization.

What do the validation levels mean?

They distinguish structural checks, a real behavior smoke test, held-out and regression testing, and verified GitHub installation with resource comparisons.

Are behavioral tests fully automated?

No complete automated evaluator is bundled. The skill provides evaluation guidance and record formats, but actual task execution and scoring require suitable tooling.

Is installation verification a security sandbox?

No. The helper changes HOME but retains host permissions and other environment variables. Use a disposable sandbox and reviewed dependencies.