{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "dbs-install-skill",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Local script or command execution: skills/dbs-install-skill/scripts/install-skill.sh (bash, executed directly by the model per SKILL.md instructions)"
    },
    {
      "file": "环境变量 / API Key",
      "summary": "Vendor service key reads: Reads $HOME and $DBS_INSTALL_HOME to locate Agent root directories (INSTALL_HOME=\"${DBS_INSTALL_HOM)"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Symlinks/Junctions under ~/.agents/skills/<name> and 6 dedicated host directories (mkdir -p target directory)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 对 skills/dbs-install-skill 全目录做 token 扫描（curl/wget/http(s)/api[_-]?key/token/secret/AWS_/ssh/scp/nc/socket/fetch 等）零命中，坐实「无网络、无凭证」；② 逐段复核脚本动作面：grep 出全部 rm/mkdir/ln/PowerShell 调用点（rm \"$link\" 322、rm -rf \"$grok_dir\" 576、rm -rf \"$dir\" 698、ln -s 337、mkdir -p 435），确认删除只针对 is_managed_link 判定通过的受管对象；③ 复核 link_one 的冲突分支（他源链接→保留 return 2、真实目录/文件→保留 return 2、Windows 提示 MSYS 实体副本）；④ 复核 Grok 生成的 heredoc 内容与 SKILL.md 声明是否一致（「必须包含 user_invocable: true，并指向真源」→ heredoc 确含该字段与 Source of truth 行）；⑤ 对 SKILL.md 每条自检项反查脚本实现，发现 private/ 一项落空（见 second_pass discrepancy）；⑥ 交叉核对仓库工具链 tools/test-dbs-install-skill*.sh 与 .github/workflows/ci.yml 对该脚本的调用面，与 SKILL.md 描述一致。",
    "second_pass": [
      {
        "item": "外部资源/工具：是否存在未披露的网络或第三方依赖",
        "status": "ok",
        "detail": "skills/dbs-install-skill 整目录（SKILL.md + install-skill.sh + windows-junction.ps1 + agents/openai.yaml）token 扫描 curl/wget/https?:///api_key/token/secret/fetch 全部零命中；脚本只调用 ln/mkdir/rm/find/awk/sed/uname/dirname/basename 与（Windows 时）pwsh/powershell，均为本机命令。external_deps 记为空数组成立。"
      },
      {
        "item": "安全结论：删除动作是否会危及用户既有文件",
        "status": "ok",
        "detail": "unlink 路径只走 unlink_if_points_to（先比对链接目标是否等于本次真源）与 unlink_grok_one；Grok 分支的 rm -rf 前面有两道门：is_managed_link、或以 grep -q '^## Grok Bridge$' 判定为本工具生成的桥接文件，否则打印「✗ 是真实目录或文件，已保留」并 return 2。link 路径同理（link_one 遇 -e \"$link\" 即保留）。未发现无条件 rm -rf。"
      },
      {
        "item": "SKILL.md 自检项「private/ 与 .private/ 没有被读取、复制、暂存或安装」是否由脚本兑现",
        "status": "discrepancy",
        "detail": "该句仅出现在 skills/dbs-install-skill/SKILL.md:203；对整个 skill 目录 grep -rni private 只此一处，install-skill.sh 与 windows-junction.ps1 中均无任何 private/.private 过滤或跳过逻辑，仓库工具层 tools/test-dbs-install-skill*.sh 也无相关用例。真实行为是：脚本对源目录建链接/桥接，既不复制也不过滤子目录，因此源 Skill 目录内若存在 private/，它会随源目录一起被 Agent 目录侧访问到（不会产生副本）。该项属文档声明超前于实现，不构成凭空夸大宣传，但「没有被读取/安装」这一表述在脚本层面无证据。"
      },
      {
        "item": "功能声明 vs 实际代码能力：SKILL.md 描述的宿主清单与脚本数组是否一致",
        "status": "ok",
        "detail": "SKILL.md 专属入口列 6 家（Claude Code/WorkBuddy/Hermes Agent/Kiro/Qwen Code/Cline），对应 NATIVE_TARGET_DIRS 恰好 6 项；公共兼容客户端列 8 家（Codex/GitHub Copilot/Gemini CLI/Cursor/Augment/Roo Code/OpenCode/OpenHands），对应 REDUNDANT_TARGET_DIRS 前 8 项注释「前 8 项已能读取 ~/.agents/skills」，数组实际长度 24（其余为旧版目录，仅用于清理）。一致。"
      },
      {
        "item": "证据定位：stars/last_push/license 是否能在 pin 源码内定位",
        "status": "unlocatable",
        "detail": "stars=10121、last_push=2026-09-07 取自站点池 data/pool.json 的机器采集字段（GitHub API），pin 工作副本为本地镜像，源码内无此数据，无法在用 read 可及的仓库文件内逐字命中；license 可在仓库根 LICENSE 逐字命中（CC BY-NC 4.0）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314",
    "sha256": "d04f021c0c5317a16e4c31d93af07c73bdc5ba5fc8e2b1c366048e04ca9888f0",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/dbs-install-skill.tar.gz",
    "sha256": "d04f021c0c5317a16e4c31d93af07c73bdc5ba5fc8e2b1c366048e04ca9888f0",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  },
  "original": {
    "github": "https://github.com/dontbesilent2025/dbskill/tree/main/skills/dbs-install-skill",
    "path": "skills/dbs-install-skill",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  }
}