Workflow & Core Tools · dontbesilent2025/dbskill

dbs-install-skill

Name: dbs-install-skill
Author: dontbesilent2025/dbskill

Installs a single Skill or a collection of Skills to universal Agents, Claude Code, Codex, WorkBuddy, Grok, Hermes Agent, Kiro, Qwen Code, Cline, and other agents. Use when users request cross-agent installation, synchronization, inspection, deduplication, or uninstallation of Skills.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit

Author dontbesilent2025GitHub dontbesilent2025/dbskill ↗Stars 10121License CC BY-NC 4.0（仓库根 LICENSE：Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)；署名 + 禁止商业使用；Copyright (c) 2026 dontbesilent）Commit 8b8e33f1ec

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

SKILL.md itself serves merely as a layer of "protocol specification + output guidelines", delegating actual installation operations to the built-in bash script; users always run the same single command, while the script automatically detects the host type and target entry points internally.

skills/dbs-install-skill/SKILL.md

用户始终使用同一条命令。脚本自动选择公共入口或专属入口，用户无需判断宿主类型，也无需添加模式参数。

This reflects a "documentation-as-an-interface" design: SKILL.md informs the model of the script's existence and invocation method, whereas the script handles all deterministic logic to prevent the model from rewriting installation commands on the fly.

The routing strategy follows a "single shared entry point first" principle: all Skills are first linked to ~/.agents/skills, and dedicated directories are provisioned only for hosts that have not yet adopted this convention, provided their home directory already exists.

skills/dbs-install-skill/SKILL.md

以下客户端当前仍使用专属目录。只有对应主目录已经存在时，脚本才创建链接：

Avoids creating directories like ~/.claude or ~/.kiro out of nowhere for uninstalled clients.

The script centrally locates all host root directories using the INSTALL_HOME variable, which defaults to $HOME and can be overridden via DBS_INSTALL_HOME (facilitating testing and sandboxing).

skills/dbs-install-skill/scripts/install-skill.sh

INSTALL_HOME="${DBS_INSTALL_HOME:-$HOME}"

Shared entry point SHARED_TARGET_DIR="$INSTALL_HOME/.agents/skills"; dedicated entry points consist of 6 array items, and redundant cleanup targets consist of 24 array items.

The actual persistence mechanism uses symbolic links (Unix) or directory junctions (Windows) without copying source files, ensuring immediate synchronization across all hosts whenever the source Skill is updated.

skills/dbs-install-skill/SKILL.md

Unix-like 系统使用符号链接；Windows 的 Bash／MSYS 环境使用目录 Junction，避免 `ln -s` 在部分配置下生成实体目录副本。

Corresponding script implementation: create_managed_link relies on run_windows_junction or ln -s.

Grok employs a "thin adapter layer" instead of symlinks: the script generates a minimal SKILL.md with user_invocable: true in the frontmatter, containing only a "Source of truth" line pointing back to the true source.

skills/dbs-install-skill/scripts/install-skill.sh

- Source of truth: $src/SKILL.md

No lengthy logic is maintained in the Grok directory ("Treat this file as a thin Grok bridge only"); modifications to the true source take effect from a single point.

The Skill name is derived from the name field in the true source's SKILL.md frontmatter rather than the directory name (parsed using awk restricted to the frontmatter section), enabling source directories to include category prefixes while maintaining stable trigger names across Agents.

skills/dbs-install-skill/SKILL.md

入口名优先读取真源 `SKILL.md` frontmatter 中的 `name`；只有 `name` 缺失时才退回源目录名。这样源目录可以使用分类前缀，各 Agent 仍保持稳定的历史触发名。

Falls back to basename if awk parsing fails or name is missing; dies immediately if name contains / or equals . / .. to prevent path traversal.

Every link operation performs an idempotent cleanup concurrently: removes redundant/historical aliases/broken links pointing to the same true source while preserving real directories and links pointing to other sources (conflicts are reported).

skills/dbs-install-skill/SKILL.md

删除公共入口兼容客户端专属目录中指向同一真源的冗余链接；

When encountering an existing real directory or file, link_one prints "✗ 是真实目录或文件，已保留" and returns 2, never overwriting.

The status action translates "the presence of redundant entry points" into deterministic exit code semantics: outputs ✓ only when no redundancy is found, and reports ✗ with a failure exit code when redundancy exists.

skills/dbs-install-skill/SKILL.md

状态正常时，脚本必须输出：

End of script: prints ✓ 未发现冗余入口 only when action=status and failed=0, passing failed directly as the process exit code.

2Core Capabilities

01Cross-host installation: Link a single Skill or an entire Skill collection to all installed hosts in one go

02Collection directory installation: Every first-level subdirectory containing a SKILL.md is processed sequentially through the same routing logic

03Installation health check and redundancy assessment (status subcommand)

04Uninstallation deletes only derived artifacts, strictly preserving the source Skill and user real directories

05Windows support: Leverages a PowerShell helper to manage Junction create/target/remove/test/list/same/under operations

06Never overwrites real directories/real files/third-party links, preserving and reporting on conflicts

07Source directory resolution precedence: Absolute path → Current working directory → Repository root → Repository skills/<name>, throwing errors immediately instead of guessing

08Stable entry names: Uses the true source frontmatter name as the link name instead of the directory name

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Local script or command execution: skills/dbs-install-skill/scripts/install-skill.sh (bash, executed directly by the model per SKILL.md instructions)
环境变量 / API Key: Vendor service key reads: Reads $HOME and $DBS_INSTALL_HOME to locate Agent root directories (INSTALL_HOME="${DBS_INSTALL_HOM)
本地工作目录: File I/O and artifact output: Symlinks/Junctions under ~/.agents/skills/<name> and 6 dedicated host directories (mkdir -p target directory)

Audit Notes: The evaluation target is this skill's own directory: it includes executable scripts (809 lines of bash + 157 lines of PowerShell helper) that operate directly on the user's home directory via bash/Windows PowerShell (creating/removing links and junctions, writing a Grok bridge SKILL.md), classifying it as "local scripts/CLI and local file I/O only, no outbound network activity". It entails no network egress, no credential reading, no package installations, and no eval; deletion operations are strictly constrained to "managed links pointing to the currently specified true source" and "the Grok directory generated by this tool", while real directories/real files/third-party links are consistently preserved and reported (exit code 2). Users should be aware that modified paths are confined under $HOME and source files are not copied by default.

5Second-Pass Verification

[ok] 外部资源/工具：是否存在未披露的网络或第三方依赖 — skills/dbs-install-skill 整目录（SKILL.md + install-skill.sh + windows-junction.ps1 + agents/openai.yaml）token 扫描 curl/wget/https?:///api_key/token/secret/fetch 全部零命中；脚本只调用 ln/mkdir/rm/find/awk/sed/uname/dirname/basename 与（Windows 时）pwsh/powershell，均为本机命令。external_deps 记为空数组成立。
[ok] 安全结论：删除动作是否会危及用户既有文件 — unlink 路径只走 unlink_if_points_to（先比对链接目标是否等于本次真源）与 unlink_grok_one；Grok 分支的 rm -rf 前面有两道门：is_managed_link、或以 grep -q '^## Grok Bridge$' 判定为本工具生成的桥接文件，否则打印「✗ 是真实目录或文件，已保留」并 return 2。link 路径同理（link_one 遇 -e "$link" 即保留）。未发现无条件 rm -rf。
[discrepancy] SKILL.md 自检项「private/ 与 .private/ 没有被读取、复制、暂存或安装」是否由脚本兑现 — 该句仅出现在 skills/dbs-install-skill/SKILL.md:203；对整个 skill 目录 grep -rni private 只此一处，install-skill.sh 与 windows-junction.ps1 中均无任何 private/.private 过滤或跳过逻辑，仓库工具层 tools/test-dbs-install-skill*.sh 也无相关用例。真实行为是：脚本对源目录建链接/桥接，既不复制也不过滤子目录，因此源 Skill 目录内若存在 private/，它会随源目录一起被 Agent 目录侧访问到（不会产生副本）。该项属文档声明超前于实现，不构成凭空夸大宣传，但「没有被读取/安装」这一表述在脚本层面无证据。
[ok] 功能声明 vs 实际代码能力：SKILL.md 描述的宿主清单与脚本数组是否一致 — SKILL.md 专属入口列 6 家（Claude Code/WorkBuddy/Hermes Agent/Kiro/Qwen Code/Cline），对应 NATIVE_TARGET_DIRS 恰好 6 项；公共兼容客户端列 8 家（Codex/GitHub Copilot/Gemini CLI/Cursor/Augment/Roo Code/OpenCode/OpenHands），对应 REDUNDANT_TARGET_DIRS 前 8 项注释「前 8 项已能读取 ~/.agents/skills」，数组实际长度 24（其余为旧版目录，仅用于清理）。一致。
[unlocatable] 证据定位：stars/last_push/license 是否能在 pin 源码内定位 — stars=10121、last_push=2026-09-07 取自站点池 data/pool.json 的机器采集字段（GitHub API），pin 工作副本为本地镜像，源码内无此数据，无法在用 read 可及的仓库文件内逐字命中；license 可在仓库根 LICENSE 逐字命中（CC BY-NC 4.0）。

6Verdict & Scenarios

Consolidates repetitive "multi-host installation" tasks into a single zero-argument default command: routing is determined by detecting host home directory existence, freeing users from memorizing individual Agent directory conventions

Relies on symlinks rather than copies, naturally eliminating multi-host version drift; concurrently prunes historical redundant entries on every run to prevent long-term degradation into out-of-sync copies

Destructive actions feature well-defined boundaries and failure semantics: real directories, real files, and third-party links are universally preserved with non-zero exit codes, allowing users to immediately identify what was not automatically handled

Honest documentation transparency: Explicitly documents constraints such as "does not create non-existent Agent home directories", "does not overwrite real directories", "uninstallation deletes only derived artifacts", and "source Skills will not be deleted", mapping directly to script implementation details

Best for: Ideal for Skill authors and power users running two or more Agent hosts simultaneously (Claude Code + Codex + Cursor/Grok/Qwen Code, etc.): single source of truth, one-stop maintenance, globally visible across all platforms. Also well-suited for batch distribution and periodic deduplication health checks across Skill collections (e.g., all 32 skills in dbskill), where the status subcommand serves as a CI/self-check hook.

Not for: Not suitable for distributing skills as version-controlled copies to third parties (this tool deliberately uses links, not copying/packaging); not suitable for Windows environments lacking PowerShell; not suitable for scenarios requiring installation into arbitrary custom directories—host directories are hardcoded arrays where the only configurable variable is the INSTALL_HOME root (via DBS_INSTALL_HOME).

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload dbs-install-skill.tar.gz

sha256: d04f021c0c5317a1…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit 8b8e33f1ec.