📦

dbs-update

Name: dbs-update
Author: dontbesilent2025

Révision du contenu r1 Risque moyen 📁 Accès au système de fichiers🔑 Variables d’environnement⚙️ Commandes externes

Update dbskill and Review Retired Skills

dbskill installations can become outdated across plugin and Skills CLI channels. This skill selects the update workflow, handles retired entries, and reports completion or failure.

Prend en charge: Claude Codex Code(CC)

📊 72 Adéquat

Maintain this Skill? Claim it 📊 72 Adéquat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "dbs-update" from https://skillstore.io/skills/dontbesilent2025-dbs-update.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-update/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/dontbesilent2025-dbs-update.md manifest signé GET /api/skills/dontbesilent2025-dbs-update/manifest lockfile signé GET /api/skills/dontbesilent2025-dbs-update/lockfile

Tester

Utilisation de « dbs-update ». Update my existing dbskill plugin installation.

Résultat attendu:

dbskill updated successfully through the Claude Code plugin channel.
Reload plugins or start a new conversation to load the updated skills.

Utilisation de « dbs-update ». Preview retired-skill cleanup without changing files.

Résultat attendu:

Dry run completed. No files changed.
The retired entry matches a known SKILL.md fingerprint and is marked for backup.
Other files are not covered by this fingerprint check; review customizations before applying cleanup.

Utilisation de « dbs-update ». Update dbskill and report any failure.

Résultat attendu:

The update did not complete because the update service was unreachable. Restore network access and request the update again.

Audit de sécurité

Risque moyen

v1 • 17/10/2026 Ouvrir le rapport versionné

Most static alerts are Markdown formatting, normal application paths, or bounded maintenance operations, not shell backticks, database access, or obfuscation. The Skills CLI update executes an unpinned package with automatic confirmation, creating a supply-chain risk. Cleanup can disable customized skills because ownership checks inspect only SKILL.md fingerprints or bridge text, rather than complete directory contents.

Fichiers analysés

251

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen

scripts/cleanup_retired_skills.py:68-84 scripts/cleanup_retired_skills.py:106-119 SKILL.md:17

Incomplete Ownership Checks Can Disable Customized Skills

Cleanup trusts a matching SKILL.md hash without inspecting other files, so customized scripts or added content can be unlinked or moved from active installation. The Grok bridge fallback also accepts editable marker text and a missing source path as sufficient ownership evidence.

The decision logic checks only SKILL.md or bridge text before unlinking or moving entries. It cannot enforce the stated promise to preserve user-modified skills.

Éléments d’évaluation des capacités (1)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

SKILL.md:38-40

Ruby/shell backtick execution

```bash

The fenced command runs npx -y skills without a version pin, automatically trusting downloaded package code. A compromised package release could execute with user permissions.

Facteurs de risque

📁 Accès au système de fichiers (12)

scripts/cleanup_retired_skills.py:7 scripts/cleanup_retired_skills.py:7 scripts/cleanup_retired_skills.py:119 scripts/cleanup_retired_skills.py:52 SKILL.md:15 SKILL.md:25 SKILL.md:47 SKILL.md:15 SKILL.md:24 SKILL.md:25 SKILL.md:47 SKILL.md:53

🔑 Variables d’environnement (1)

scripts/cleanup_retired_skills.py:91

⚙️ Commandes externes (21)

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-update/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-update?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-update?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-update/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-update.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

dontbesilent2025. (2026). dbs-update security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1

Citation BibTeX

@techreport{dontbesilent2025-dontbesilent2025-dbs-update-2026,
  author = {dontbesilent2025},
  title = {dbs-update security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-update security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-update:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Refresh Installed Plugins

Update installed dbskill plugins through their existing marketplace channel without creating a duplicate Skills CLI installation.

Maintain Local Agent Skills

Refresh the dbskill repository in a Skills CLI installation and identify retired entries in supported agent directories.

Review Retirement Actions

Preview cleanup decisions, inspect retained items, and review backups before accepting changes to shared development environments.

Essayez ces prompts

Update dbskill

Update my dbskill installation through its existing channel and report whether the update completed.

Inspect Installation Channels

Identify my dbskill installation channels and explain the applicable update steps. Do not install, update, or remove anything.

Preview Retirement Cleanup

Run only the bundled retirement cleanup script in dry-run mode. Summarize planned removals, backups, and retained entries without changing files.

Audit Customized Retired Entries

Compare each retired entry's complete contents before cleanup. Preserve customized entries, explain fingerprint limitations, and request approval before moving or unlinking anything.

Bonnes pratiques

Identify the existing installation channel before updating to avoid duplicate installations.
Preview cleanup and inspect complete directory contents before retiring entries with possible customizations.
Use a reviewed Skills CLI version and verify backups and command exit status before accepting completion.

Éviter

Use a broad skills-update command that also changes unrelated skills.
Treat an unchanged SKILL.md file as proof that an entire directory is unmodified.
Interpret an isolated numeric reply as update consent without a preceding dbskill update reminder.

Foire aux questions

Which installation channels are supported?

The instructions cover Claude Code plugins and Skills CLI installations. Both channels can be updated when both are detected.

Does asking about versions start an update?

No. Version questions should receive an answer without update commands. An explicit update request or contextual confirmation authorizes updating.

Will this update unrelated skills?

The workflow targets the dbskill repository and its named marketplace plugins. It explicitly prohibits the broad skills-update command.

How does cleanup handle customized entries?

It retains entries with unrecognized SKILL.md contents, but may retire customized directories whose SKILL.md still matches. Review complete contents first.

Can cleanup run without changing files?

Yes. The bundled Python script supports dry-run mode. Without Python, the workflow skips local cleanup and requests manual inspection.

Where are retired directories backed up?

Qualifying directories move into a timestamped retired-skills folder under the .dbs application directory. Links are removed without deleting their targets.