Workflow & Core Tools · dontbesilent2025/dbskill
dbs
Primary entry point for the dontbesilent commercial toolkit, providing beginner tutorials and dynamic single-task orchestration. Use when trying dbskill for the first time, unsure which official Skill to use, seeking appropriate capabilities for a real task, or asking for next steps upon task completion.
L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.
1How It Works & Mechanism
dbs is a pure prompt orchestration entry point that does only two things—beginner onboarding and single-task orchestration—and explicitly delegates concrete business execution to downstream Skills invoked in the subsequent round.
skills/dbs/SKILL.md
本 Skill 只负责发现候选、判断单项或组合、分配角色和生成提示词。具体诊断、研究、制作、检查与执行留给用户下一轮调用的下游 Skill。
What is happening here: thoroughly decoupling 'routing' from 'execution' across two rounds—the current round only outputs a ready-to-send prompt, leaving all business conclusions to be generated when the user actually invokes the leaf Skill in the next round. This prevents the entry Skill from overstepping its boundaries and producing unauthorized outputs, while allowing users to review the orchestrated prompt before execution.
Runs a version check script upon entering the skill: executes bash scripts/check-update.sh, reads the official UPDATE.json, connects to the network at most once every 24 hours, and writes the cache to ~/.dbs/update_check_at.
skills/dbs/SKILL.md
DBS_LOCAL_VERSION="2.18.40"; bash "<本 SKILL.md 所在目录>/scripts/check-update.sh" "$DBS_LOCAL_VERSION"
The script is real executable code (not a prompt placeholder): skills/dbs/scripts/check-update.sh fetches https://raw.githubusercontent.com/dontbesilent2025/dbskill/main/UPDATE.json via curl, parses it with python3 (falling back to node), and performs semver comparison. If the remote version is higher, it prints a single line: 'dbskill vX: <notice> Reply 1 to update now.' SKILL.md requires 'silently skip if the command yields no output, fails, or times out', ensuring script failure never blocks orchestration.
Candidate discovery also relies on a script: runs python3 scripts/list-official-skills.py, using .claude-plugin/marketplace.json as the authoritative source for public candidates, falling back to a versioned name snapshot if the file is missing.
skills/dbs/SKILL.md
脚本在完整项目中以当前版本的 `.claude-plugin/marketplace.json` 为公开候选权威源；独立 Skill 安装包缺少 Marketplace 文件时，使用随版本构建并经过一致性检查的正式名称快照。
The implementation of list-official-skills.py is at skills/dbs/scripts/list-official-skills.py: looks upward for .claude-plugin/marketplace.json, falling back to references/official-skill-names.txt; then locates installed skills across project skills/ and user directories (~/.agents/skills, ~/.codex/skills, ~/.claude/skills), outputting JSON containing name/description/source. Exclusion rules are hardcoded in the script: skips entries named dbs and those containing beta/private.
Orchestration decisions follow an auditable criteria set: 5 candidate evaluation factors (task outcome/input match/stage match/boundary match/executability), prioritizing a single Skill and only composing when necessary, with a strict hard cap of 1 primary + 2 secondary.
skills/dbs/SKILL.md
总量不超过 1 个主 Skill 和 2 个辅助 Skill。
The 5 prerequisite conditions for composition are detailed in the same section ('user has only 1 final task and 1 final deliverable', 'at least 2 independent requirements that alter candidate selection, evidence, stopping conditions, or acceptance criteria', etc.), accompanied by 3 secondary roles (pre-filtering / evidence supplementary / acceptance constraints) with their respective dependency positions; complete role/ordering/fallback specifications are externalized in references/composition-contract.md and loaded only when composition is determined—a classic progressive disclosure design.
Output discipline: immediately ends the turn after generating a single prompt, without previewing downstream business conclusions.
skills/dbs/SKILL.md
没有第二个辅助 Skill 时省略对应内容。提示词生成后立即结束当前轮次。
The single-Skill output template requires 'Recommendation: `/{skill-name}` + single-sentence rationale + ready-to-send prompt'; the composition template mandates specifying primary/secondary divisions of labor and 'ultimately delivering only a single result led by the primary Skill, without sequentially concatenating reports from multiple Skills'. Templates are hardcoded in the body of SKILL.md to guarantee consistent output formatting across turns.
Cross-Skill handover contract: dbs is the sole dynamic orchestration hub; leaf Skills must not cross-refer one another, and next steps must not be discussed before task completion.
skills/dbs/SKILL.md
`/dbs` 是正式 Skill 之间唯一的动态编排中心。
Supporting clauses: a leaf Skill exits immediately upon completing its current task, prompting 'If unsure about the next step, enter `/dbs`' only when the user explicitly asks for next steps; when invoked mismatched, a Skill preserves extracted information and hands back control to /dbs. This contract is replicated verbatim at the end of the other 31 leaf Skills, establishing a repository-wide single entry point architecture.
2Core Capabilities
01Beginner Tutorial (Mode A): Explains deliverables, system workings, and how to get started to first-time users
02Task Orchestration (Mode B): Recovers the single task from current context, outputting a single Skill recommendation or a 1 primary + ≤2 secondary composition
03Candidate Discovery: Treats official Marketplace entries as authoritative, running scripts to enumerate installed official Skills and real source paths
04Version Alerts & One-Click Update: Script compares remote version numbers, appending an alert to the response end when triggered, executing /dbs-update upon user replying '1'
05Permission & Safety Gate: Orchestration never auto-escalates permissions; halts orchestration and demands prior review when detecting suspicious Skills or sensitive data risks
06Empty Dialogue Guidance: Offers low-friction entry messaging when no recognizable task is present, preventing idle loops
3External Dependencies
| Kind | Dependency / Endpoint |
|---|---|
| cli | bash |
| cli | curl |
| network | 官方 UPDATE.json（版本检查，可用环境变量覆盖） |
| cli | python3 |
| cli | node（python3 不可用时的解析兜底） |
4Recommended Governance & Evidence
Suggested Controls for Safe Operation
For Agent Runtime
Graded/per-use authorization, sandbox recommended
For Administrators
Approval workflow, rollback support, full audit
Evidence & Triggers (File Paths & Excerpts)
- scripts/: Executes local script or command: bash <skill_directory>/scripts/check-update.sh "2.18.40" (executed every time this skill is invoked)
- 网络端点: Declares external network access: GET https://raw.githubusercontent.com/dontbesilent2025/dbskill/main/UPDATE.
- 本地工作目录: File I/O and artifact output: mkdir -p ~/.dbs and writes to ~/.dbs/update_check_at (overwriting with current unix timestamp)
Audit Notes: . The assessment is based on behavioral characteristics rather than brand reputation: this skill executes local scripts where check-update.sh issues a GET request to raw.githubusercontent.com upon entry (skipped within the 24h cache window) and writes a cache file to $HOME/.dbs/; it accesses no credentials and exfiltrates no user data (requests contain no parameters, cookies, or payload), targeting a single, predictable endpoint, matching the 'standard network call (public API/official CLI)' tier. According to the Batch 4 final criteria Tier 3 (queries to fixed public endpoints, predictable low-risk outbound requests such as official CLI update/check; precedents include guizang-ppt / archify / llm-icon-finder), it is classified as yellow: check-update.sh runs on skill entry and unconditionally sends a GET request to a fixed public endpoint (skipped only within 24h cache), representing an update/check outbound call rather than an optional or policy-referenced feature. Two nuances to note: the environment variable DBS_UPDATE_URL can redirect the request to an arbitrary host (supply chain surface, though parsing includes length, newline, and regex validation, capping the worst-case impact to a forged version alert under 80 characters); list-official-skills.py reads user home skill directories and prints absolute paths into the dialogue. Otherwise, it strictly prohibits automatic privilege escalation ('orchestration does not automatically expand read, write, publish, delete, payment, or external communication permissions').
5Second-Pass Verification
- [ok] 两个脚本真实存在且可执行语义与描述一致 — skills/dbs/scripts/check-update.sh（116 行 bash）与 skills/dbs/scripts/list-official-skills.py（python3）均逐行读过；SKILL.md 对二者行为的描述（24h 缓存、marketplace 优先、快照兜底、只返回已安装正式 Skill）与实现一致，无夸大。
- [ok] 网络外发唯一且为官方端点 — 全目录 token 扫描只命中一处 curl，指向 raw.githubusercontent.com/dontbesilent2025/dbskill/main/UPDATE.json；无 webhook、无上报、无第三方域名。
- [ok] 凭证读取为零 — 脚本只读 $HOME 路径与可选 DBS_UPDATE_URL；无 token/api_key/keychain/.env/.netrc 读取。
- [ok] 写文件范围（仅 ~/.dbs 缓存） — check-update.sh 中唯一写入是 mkdir -p "$DBS_DIR" 与 printf 时间戳到 ~/.dbs/update_check_at；list-official-skills.py 无 write 调用（只 read_text/print）。
- [ok（确认为设计内行为）] 远端 notice 文本会进入模型上下文（注入面） — SKILL.md 明确要求「命令有输出时，将输出内容追加在本次回复的最末尾，单独成段，引用格式为 > 🔔 {输出内容}」；notice 由脚本做 1–80 字与禁换行校验，非任意长文本。已按「远端可控字符串入上下文」如实计入 injection_surface。
- [ok] 版本号硬编码 2.18.40 与仓库 VERSION 一致 — SKILL.md 的 DBS_LOCAL_VERSION="2.18.40" 与仓库根 VERSION 文件（2.18.40）、UPDATE.json.version（2.18.40）三处一致。
- [ok] 「编排不自动扩权」是否只是口号 — SKILL.md 有可执行的落地条款：任一成员需要新增授权时把授权条件写进提示词、本入口不代替用户授权；组合条件第 4 条要求「组合不会绕过任何成员的证据、权限、安全或停止边界」。属提示层约束（无代码级强制），已在 risks 中说明。
- [ok] 元数据（license/stars/last_push/installs） — GitHub API：stargazers_count 10121、pushed_at 2026-09-07T03:48:59Z、license.spdx_id NOASSERTION（仓库根 LICENSE 实为 CC BY-NC 4.0，非商业）；skills.sh 徽标 579.6K 为仓库级聚合。本地 git HEAD = 8b8e33f1ecaed8cee606fe950c4426b525ead314，与任务 pin 一致。
6Verdict & Scenarios
Best for: Ideal for users who have installed dbskill (family of 32 official Skills) and do not want to memorize the purpose of each Skill: pass the real task as-is to /dbs to let it determine a single Skill or primary/secondary composition and generate a ready-to-send prompt. Also suitable for skill developers seeking to learn how entry Skills handle candidate discovery, composition orchestration, and prompt generation (the script-based candidate discovery, hard-capped composition, and progressive disclosure patterns can be directly adopted). When installed standalone (without marketplace.json), it remains functional via name snapshots, though candidate descriptions degrade to reading SKILL.md frontmatter, reducing filtering precision.
Not for: Not suitable for environments where only a single dbs family Skill is installed—without a candidate pool, orchestration degrades to idling (the script returns an empty list, in which case that leaf Skill should be invoked directly). Not suitable for users expecting immediate business conclusions in one turn: this entry explicitly forbids executing downstream business workflows in the current round, requiring another prompt submission. Not suitable for using /dbs as a conversational assistant—it orchestrates only the current single task per round, preserving no fixed cross-task combinations or default long chains. Also unsuitable for offline or restricted-network environments expecting complete network silence, as it introduces an outbound request (every 24h) to raw.githubusercontent.com.
Install Agent-Ready
① Verified Mirror 2026-09-15
Option A · Direct DownloadDownload dbs.tar.gz
sha256:
Option B · Copy Guide for Agentab141ef415ad29ec…Agents automatically download and verify mirrors from this JSON guide.
② Upstream GitHub
GitHub Repo ↗
Pinned to commit 8b8e33f1ec.