Home / All Skills / Workflow & Core Tools / dbs-skill-maker
English (EN)简体中文 (ZH)日本語 (JA)
Workflow & Core Tools · dontbesilent2025/dbskill

dbs-skill-maker

Converts recurring problems into installable, hierarchically verifiable standalone Skills through requirement analysis. Used when the user requests creating a Skill, crystallizing a problem into a Skill, or checking/testing a candidate Skill; prepares a GitHub repository and verifies `npx skills add` only when the user explicitly requests sharing or publishing.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandExternal WriteNetwork AccessWrite FileDual-pass Audit
Author dontbesilent2025GitHub dontbesilent2025/dbskill ↗Stars 10121License CC BY-NC 4.0（非商业授权）：仓库根 LICENSE 为 Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)，Copyright (c) 2026 dontbesilent；GitHub API license.spdx_id = NOASSERTION （CC BY-NC 4.0 非 SPDX 标准文本，GitHub 无法自动识别），不得用于商业用途Commit 8b8e33f1ec
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The primary entry point is a state table: read the current dialogue and target directory first, then decide which single references file to load based on 'current evidence' instead of stuffing the entire workflow in at once.

skills/dbs-skill-maker/SKILL.md
| 只有一个想法，问题和完成态不清 | 形成问题契约与完成条件 | [references/problem-and-goal.md](references/problem-and-goal.md) |
What is happening here: uses a state machine + progressive disclosure to control context costs—a 7-line routing table covers the entire lifecycle from idea to publication, explicitly stating 'do not turn the table into a rigid questionnaire or demand item-by-item selection from the user'.

Treat the skill package structure as a design constraint: keep common decisions in SKILL.md, delegate conditional knowledge down to references/, and delegate repetitive, deterministic operations down to scripts/.

skills/dbs-skill-maker/SKILL.md
**主入口保持轻。** `SKILL.md` 保存共同决策、关键流程和停止条件；条件性细节放进 `references/`，重复且确定的工作放进 `scripts/`。
This invariant directly explains why this skill comes with 5 references + 4 scripts, and where its capability boundaries lie.

Delivery discipline is 'start from the problem + generate real files directly'; passing off solution descriptions or empty skeletons as finished products is prohibited.

skills/dbs-skill-maker/SKILL.md
**从问题开始。** 先确定 Skill 反复解决什么问题、在什么情境使用、出现什么证据算完成。
See the 'Generate Candidate' section for accompanying constraints: scripts only generate first drafts with real content; the Agent must complete decision conditions and boundaries before delivery.

Use executable scripts to handle deterministic tasks: skeleton initialization, structural validation, release staging, and npx installation verification, with four scripts each handling one phase.

skills/dbs-skill-maker/scripts/init_skill_project.py
Create a minimal single-Skill project without overwriting existing files."""
The init script does not overwrite existing files; the validate script performs static checks for frontmatter/references/assets/scripts; the prepare script writes only to local staging; verify_npx_install.sh runs a genuine installation in a temporary HOME.

The validation script intercepts unfinished placeholders and suspected secrets, turning 'skeleton handoffs' and 'leaked secrets' into mechanically detectable failures.

skills/dbs-skill-maker/scripts/validate_skill_project.py
UNFINISHED_MARKERS = ("[TODO", "TODO:", "FIXME", "{说明", "{写入", "{可观察", "<待填写>")
The same file contains LOCAL_PATH_PATTERN (local absolute paths) and SECRET_PATTERN (api_key/token/secret/password) regexes for pre-release interception.

Verification is divided into four tiers and can only be stated according to the highest tier actually executed; packaging structural validation as 'verified' is prohibited.

skills/dbs-skill-maker/SKILL.md
未实际运行行为任务时，只能报告第 1 级。没有留出收益或出现关键回归时，不能宣称 Skill 已经变强。详细记录方式见 [references/evaluation.md](references/evaluation.md)。
Four tiers: structural validation → behavioral smoke test → holdout/regression → GitHub npx install delivery; requires 3–6 samples covering boundaries and near-neighbor counterexamples, with the executor forbidden from reading answers in advance.

Any remote side effects require separate authorization: preparing a repository ≠ obtaining authorization to push.

skills/dbs-skill-maker/SKILL.md
准备仓库不等于获得远端写入授权。执行 `gh repo create`、`git push`、创建 tag 或 Release 前，确认用户的明确要求能够覆盖该动作。
Both SKILL.md and references/github-publishing.md list gh repo create / git push / tag / Release as actions requiring explicit user consent.

The integrity of the publishing pipeline is verified via script: execute npx installation in an isolated temporary HOME, then run file-by-file cmp between the source directory and installation result.

skills/dbs-skill-maker/scripts/verify_npx_install.sh
HOME="$temporary_home" "$skill_maker_npx" -y skills add "$source_locator" -g --all
The script also rejects source directories containing symlinks, validates frontmatter name, compares SKILL.md/agents/references/scripts/assets file-by-file, and cleans up the temporary directory on exit.

Staging discipline before publishing is codified as a hard rule: git add . / git add -A is prohibited; stage only via explicit paths.

skills/dbs-skill-maker/SKILL.md
不使用 `git add .` 或 `git add -A`；发布时只暂存明确文件。
The 'Release Gate' in github-publishing.md further mandates inspecting diffs, untracked files, secrets, personal paths, and evals/.

2Core Capabilities

01Requirement Analysis: Transform recurring issues into problem contracts (context, target changes, proof of completion, excluded near-neighbor problems)
02Behavioral Contract: Rewrite adjectives like 'useful/professional' into observable required behaviors and prohibited behaviors
03Mechanism Selection: Deconstruct decision actions first, then decide whether theories, rules, materials, or scripts are required
04One-click Skill project skeleton generation (init_skill_project.py, includes real first-draft content and will not overwrite existing files)
05Static structural validation (validate_skill_project.py: frontmatter, references, assets, unfinished placeholders, secrets/local paths)
06Tiered behavioral verification: 3–6 samples covering positive cases/boundaries/near-neighbor counterexamples/holdouts, reported at the highest actual tier
07GitHub publishing preparation and installation verification (staging directory + isolated environment npx installation + file-by-file comparison)
08Local delivery report checklist (paths, boundaries, generated files, executed validations, unverified risks, invocation methods)

3External Dependencies

KindDependency / Endpoint
clipython3（运行自带 scripts/*.py；纯本地，无网络）
packageskills —— 生态官方安装器包（仅发布验证脚本经 npx -y 拉取执行）
cligit / gh（仅发布流程，且需用户授权；凭据由宿主 CLI 自理）
networkGitHub（远端仓库创建/推送）与 npm registry（npx 取包）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation
For Agent Runtime
Graded/per-use authorization, sandbox recommended
For Administrators
Approval workflow, rollback support, full audit
Evidence & Triggers (File Paths & Excerpts)
  • scripts/: Execute local scripts or commands: python3 scripts/init_skill_project.py <skill-name> --output <parent_dir> (generates new Skill)
  • 外部 API: Perform posts, resource creation, or write operations on external platforms
  • 本地工作目录: File read/write and artifact output: Create new Skill directories and files in user-specified parent directory (init_skill_project.py, refuses to overwrite existing real directories)
Audit Notes: Grading basis is entirely derived from actual behaviors within this skill directory and is self-evident: three Python scripts (init_skill_project.py / validate_skill_project.py / prepare_github_repo.py) only perform local file creation and static validation without network access or credential reading; the sole outbound action occurs in the publishing pipeline—the included script scripts/verify_npx_install.sh contains `HOME="$temporary_home" "$skill_maker_npx" -y skills add "$source_locator" -g --all`, which installs packages from public registry/GitHub via the ecosystem's official installer npx skills and performs file-by-file comparison, along with references/github-publishing.md driving user-authorized git/gh remote publishing ('Stop before push, tag, or Release if authorization is unclear'). This constitutes 'expected low-risk outbound action via official CLI', sends no user materials/prompts to any generation backend, references no third-party generation services, and skill scripts do not read credentials or private tokens, thus classified as 🟡 rather than 🟠.

5Second-Pass Verification

  • [ok] SKILL.md 的状态路由表真实存在且引用文件齐全 — 7 行路由表引用的 5 个 references 文件全部存在于 skills/dbs-skill-maker/references/。
  • [ok] 四个脚本各自用途与宣称一致 — init/validate/prepare 三个 python 脚本 + 1 个 bash 安装验证脚本，均实读确认；validate 内确有 subprocess 用于 py 语法检查。
  • [ok] "准备仓库不等于获得远端写入授权"可定位 — SKILL.md「GitHub 发布边界」节原文含该句；github-publishing.md「授权边界」节给出同义规则。
  • [ok] 安装验证不是文字检查而是真装 — verify_npx_install.sh 用 mktemp 临时 HOME 执行 npx skills add，并逐文件 cmp 源目录与安装结果，输出"安装验证通过"计数。
  • [ok] 网络/远端依赖清单无遗漏 — 目录级扫描仅命中 npx（verify 脚本与 SKILL.md 安装命令）、git/gh、GitHub/npm 相关文本；三个 python 脚本无 urllib/requests/socket 调用。
  • [ok] 是否读取用户凭证 — 三个 python 脚本均无读取 ~/.gitconfig、gh 配置或 env 中 token 的代码；SECRET_PATTERN 仅用于扫描候选文件中的疑似密钥以拦截外泄。
  • [ok] "不覆盖现有真实目录"是否属实 — init_skill_project.py docstring 为 "Create a minimal single-Skill project without overwriting existing files."，并含同名冲突检查。
  • [ok] 分级验证等级表与"只能报第 1 级" — SKILL.md「未实际运行行为任务时，只能报告第 1 级。」与四级表格并存，无夸大表述。

6Verdict & Scenarios

  • Turns 'building skills' into a state-machine engineering process: loads only the required reference based on current evidence, avoiding context flooding.
  • No empty talk in verification tiers: binds four levels ('structural validation / behavioral smoke / holdout regression / install delivery') to permitted phrasing, prohibiting validation from being passed off as verification.
  • Built-in executable quality gates: unfinished placeholders, local absolute paths, and suspected secrets are blocked during static structural validation.
  • Publishing pipeline is verifiable rather than 'claimed in docs': performs a genuine install in an isolated HOME with file-by-file comparison.
  • Side effects gated by authorization and publishing discipline: remote actions require individual authorization, git add . is banned, and symlink packaging is prohibited.
    • Best for: Suitable for individual creators and engineering practitioners who want to crystallize recurring problems into installable, reusable Skills; also suitable for maintainers who need to perform structural validation and tiered behavioral verification (including holdout samples) on candidate Skills, as well as sharing scenarios requiring publishing Skills to GitHub and delivering via npx skills add.
    Not for: Not suitable for users looking for a one-off solution to a specific business issue (that is the duty of a domain skill, not a meta-skill); not suitable for scenarios unwilling to provide problem contracts and completion proof while only seeking 'templates/shells' (this skill explicitly rejects skeleton handoffs); not suitable for expectations equating 'verified' with quality certification; must not proceed to GitHub publishing workflows without user authorization.
    Install Agent-Ready
    ① Verified Mirror 2026-09-15
    Option A · Direct DownloadDownload dbs-skill-maker.tar.gz
    sha256: e296c070f776d446…
    Option B · Copy Guide for Agent
    install.json
    Agents automatically download and verify mirrors from this JSON guide.
    ② Upstream GitHub
    GitHub Repo ↗
    Pinned to commit 8b8e33f1ec.