Skills dbs-update

📦

dbs-update

Name: dbs-update
Author: dontbesilent2025

Content revision r1 Medium Risk 📁 Filesystem access🔑 Env variables⚙️ External commands

Update dbskill and Review Retired Skills

dbskill installations can become outdated across plugin and Skills CLI channels. This skill selects the update workflow, handles retired entries, and reports completion or failure.

Supports: Claude Codex Code(CC)

📊 72 Adequate

Maintain this Skill? Claim it 📊 72 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "dbs-update" from https://skillstore.io/skills/dontbesilent2025-dbs-update.md and its manifest at https://skillstore.io/api/skills/dontbesilent2025-dbs-update/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dontbesilent2025-dbs-update.md Signed manifest GET /api/skills/dontbesilent2025-dbs-update/manifest Signed lockfile GET /api/skills/dontbesilent2025-dbs-update/lockfile

Test it

Using "dbs-update". Update my existing dbskill plugin installation.

Expected outcome:

dbskill updated successfully through the Claude Code plugin channel.
Reload plugins or start a new conversation to load the updated skills.

Using "dbs-update". Preview retired-skill cleanup without changing files.

Expected outcome:

Dry run completed. No files changed.
The retired entry matches a known SKILL.md fingerprint and is marked for backup.
Other files are not covered by this fingerprint check; review customizations before applying cleanup.

Using "dbs-update". Update dbskill and report any failure.

Expected outcome:

The update did not complete because the update service was unreachable. Restore network access and request the update again.

Security Audit

Medium Risk

v1 • 10/17/2026 Open versioned report

Most static alerts are Markdown formatting, normal application paths, or bounded maintenance operations, not shell backticks, database access, or obfuscation. The Skills CLI update executes an unpinned package with automatic confirmation, creating a supply-chain risk. Cleanup can disable customized skills because ownership checks inspect only SKILL.md fingerprints or bridge text, rather than complete directory contents.

Files scanned

251

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/cleanup_retired_skills.py:68-84 scripts/cleanup_retired_skills.py:106-119 SKILL.md:17

Incomplete Ownership Checks Can Disable Customized Skills

Cleanup trusts a matching SKILL.md hash without inspecting other files, so customized scripts or added content can be unlinked or moved from active installation. The Grok bridge fallback also accepts editable marker text and a missing source path as sufficient ownership evidence.

The decision logic checks only SKILL.md or bridge text before unlinking or moving entries. It cannot enforce the stated promise to preserve user-modified skills.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:38-40

Ruby/shell backtick execution

```bash

The fenced command runs npx -y skills without a version pin, automatically trusting downloaded package code. A compromised package release could execute with user permissions.

Risk Factors

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dontbesilent2025-dbs-update/security.svg)](https://skillstore.io/skills/dontbesilent2025-dbs-update?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dontbesilent2025-dbs-update?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dontbesilent2025-dbs-update/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dontbesilent2025-dbs-update.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

dontbesilent2025. (2026). dbs-update security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1

BibTeX citation

@techreport{dontbesilent2025-dontbesilent2025-dbs-update-2026,
  author = {dontbesilent2025},
  title = {dbs-update security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dbs-update security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "dontbesilent2025"
date-released: "2026-10-17"
url: "https://skillstore.io/skills/dontbesilent2025-dbs-update/audits/1"
identifiers:
  - type: other
    value: "skillstore:dontbesilent2025-dbs-update:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Refresh Installed Plugins

Update installed dbskill plugins through their existing marketplace channel without creating a duplicate Skills CLI installation.

Maintain Local Agent Skills

Refresh the dbskill repository in a Skills CLI installation and identify retired entries in supported agent directories.

Review Retirement Actions

Preview cleanup decisions, inspect retained items, and review backups before accepting changes to shared development environments.

Try These Prompts

Update dbskill

Update my dbskill installation through its existing channel and report whether the update completed.

Inspect Installation Channels

Identify my dbskill installation channels and explain the applicable update steps. Do not install, update, or remove anything.

Preview Retirement Cleanup

Run only the bundled retirement cleanup script in dry-run mode. Summarize planned removals, backups, and retained entries without changing files.

Audit Customized Retired Entries

Compare each retired entry's complete contents before cleanup. Preserve customized entries, explain fingerprint limitations, and request approval before moving or unlinking anything.

Best Practices

Identify the existing installation channel before updating to avoid duplicate installations.
Preview cleanup and inspect complete directory contents before retiring entries with possible customizations.
Use a reviewed Skills CLI version and verify backups and command exit status before accepting completion.

Avoid

Use a broad skills-update command that also changes unrelated skills.
Treat an unchanged SKILL.md file as proof that an entire directory is unmodified.
Interpret an isolated numeric reply as update consent without a preceding dbskill update reminder.

Frequently Asked Questions

Which installation channels are supported?

The instructions cover Claude Code plugins and Skills CLI installations. Both channels can be updated when both are detected.

Does asking about versions start an update?

No. Version questions should receive an answer without update commands. An explicit update request or contextual confirmation authorizes updating.

Will this update unrelated skills?

The workflow targets the dbskill repository and its named marketplace plugins. It explicitly prohibits the broad skills-update command.

How does cleanup handle customized entries?

It retains entries with unrecognized SKILL.md contents, but may retire customized directories whose SKILL.md still matches. Review complete contents first.

Can cleanup run without changing files?

Yes. The bundled Python script supports dry-run mode. Without Python, the workflow skips local cleanup and requests manual inspection.

Where are retired directories backed up?

Qualifying directories move into a timestamped retired-skills folder under the .dbs application directory. Links are removed without deleting their targets.