Workflow & Core Tools · dontbesilent2025/dbskill

dbs-update

Name: dbs-update
Author: dontbesilent2025/dbskill

Updates the official dbskill while preserving other Skills and user archives. Used when the user requests to update, upgrade, or check the dbskill version, or replies with 1 following an update prompt.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit

Author dontbesilent2025GitHub dontbesilent2025/dbskill ↗Stars 10121License CC BY-NC 4.0（非商业授权）：仓库根 LICENSE 为 Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)，Copyright (c) 2026 dontbesilent；GitHub API license.spdx_id = NOASSERTION （CC BY-NC 4.0 非 SPDX 标准文本，GitHub 无法自动识别），不得用于商业用途Commit 8b8e33f1ec

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The entire skill relies on a single sync command: using the official installer to install all official Skills from the official repository into supported Agents.

skills/dbs-update/SKILL.md

npx -y skills add dontbesilent2025/dbskill -g --all

The command is singular and hardcoded to the dontbesilent2025/dbskill target, refusing parameterized alternate repositories—this is the first rule in the "Update Scope" section.

Writes a local timestamp after updating to prevent repeated notifications while the current conversation still holds the older Skill in memory.

skills/dbs-update/SKILL.md

mkdir -p "$HOME/.dbs" && date +%s > "$HOME/.dbs/update_check_at"

The identical timestamp file is read by /dbs's check-update.sh for a 24-hour cache, sharing the same semantics across both sides.

Hard scope boundaries: updates only the official repository, preserves user archives, leaves other Skills untouched, creates no background tasks, and explicitly prohibits commands that could inadvertently affect other Skills.

skills/dbs-update/SKILL.md

不使用 `npx skills update`，该命令可能更新用户安装的其他 Skill。

The four scope boundaries (Update Scope) plus three general boundaries (Boundaries section) jointly restrict the "update" strictly to official content.

Trigger semantics are strictly tied to context: a standalone `1` signifies an update only when the assistant's immediately preceding reply contained an update notification; otherwise, digits must not be interpreted arbitrarily.

skills/dbs-update/SKILL.md

缺少这段上下文时，不要自行解释数字含义。

This prevents casual replies like "1" from being treated as authorization to update—the skill specifies that both triggers (explicit request / "1" following a reminder) execute directly without a second textual confirmation.

Notification mechanisms are provided by the /dbs entrypoint within the same repo: version comparison + 24-hour cache + fixed "reply 1" phrasing; dbs-update merely consumes this context.

skills/dbs/scripts/check-update.sh

回复 1，我现在帮你更新。\n' "$REMOTE_VERSION" "$NOTICE"

check-update.sh reads remote versions from UPDATE.json and outputs notifications detailing the version number and user benefits only when remote is newer; the cache file is ~/.dbs/update_check_at (CACHE_TTL=86400).

Reply templates are fixed to success or failure formats; failures output only a single-sentence reason and next steps without dumping entire terminal logs.

skills/dbs-update/SKILL.md

不要把完整终端日志直接贴给用户，除非用户要求。

The success message also includes an operational reminder to "start a new conversation before using new capabilities"—because the active session may still retain legacy Skills.

Version consistency is enforced by repository toolchains: the update contract holds valid only when VERSION strictly matches the marketplace/plugin manifests.

tools/check-plugin-update-contract.py

errors.append(f"插件 {name} 的更新版本为 {plugin_version!r}，应为 {version!r}")

Repository-level contract: VERSION adopts MAJOR.MINOR.PATCH, and all marketplace plugin versions must match plugin.json versions identically (currently 2.18.40).

2Core Capabilities

01One-click sync for all official Skills from official dbskill (npx skills add -g --all)

02Record update timestamp (~/.dbs/update_check_at) to prevent duplicate notifications

03Narrow update scope: official repo only, preserves ~/.dbs archives, leaves other Skills untouched, no background tasks

04Trigger evaluation: explicit request or `1` following a prompt, without secondary textual confirmation

05Fixed success/failure reporting templates, no raw logs on failure

06Version and changelog Q&A (does not execute commands when only inquiring about versions)

3External Dependencies

Kind	Dependency / Endpoint
cli	npx（执行官方生态安装器 skills）
package	skills —— 生态官方安装器包（npx -y 即时拉取执行）
network	GitHub / npm registry（拉取 skills 包与官方仓库内容）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Execute local script or command: npx -y skills add dontbesilent2025/dbskill -g --all (the sole action specified in SKILL.md; executes official ecosystem
网络端点: Declare external network access: npx pulls npm package skills and accesses GitHub to fetch dontbesilent2025/dbskill content (SKILL.md Step 1
本地工作目录: File I/O and artifact output: $HOME/.dbs/update_check_at (timestamp, used for internal caching)

Audit Notes: Grading basis is derived entirely from verifiable actions within this skill's directory: SKILL.md Step 1 executes `npx -y skills add dontbesilent2025/dbskill -g --all`—updating/installing the official repo via the official ecosystem installer, with outbound traffic directed to public registries and GitHub, fitting the final Batch 4 criteria of "predictable, low-risk outbound requests such as official CLI update/check"; Step 2 only writes a local timestamp ~/.dbs/update_check_at. It transmits no user materials/prompts, exposes no generative or service backends, and reads no credentials or private tokens, thus classified as 🟡 instead of 🟠. Scope is hardcoded to official repositories, explicitly excluding `npx skills update` which could mistakenly affect other Skills.

5Second-Pass Verification

[ok] 目标仓库写死且唯一 — SKILL.md 命令与"更新范围"节均只涉及 dontbesilent2025/dbskill，无参数化仓库输入。
[ok] "不更新其他 Skill"有显式反例约束 — 原文"不使用 `npx skills update`，该命令可能更新用户安装的其他 Skill。"
[ok] "回复 1"的语义绑定上一轮提醒 — SKILL.md 第二段与 skills/dbs/SKILL.md 都规定必须有上一条提醒上下文，否则不得解释数字含义。
[ok] 时间戳缓存机制可回源 — check-update.sh 定义 CACHE_FILE="$DBS_DIR/update_check_at" 与 CACHE_TTL=86400，与 SKILL.md 的第 2 步配合。
[ok] 更新日志/版本信息确实存在且为远端来源 — 仓库根 UPDATE.json（version 2.18.40 + notice）与 VERSION 文件存在；check-update.sh 默认从 raw.githubusercontent.com 读取。
[ok] 是否读取用户凭证或存档内容 — 两条命令均不读取 ~/.dbs 内的存档/报告/决策记录（仅创建目录并写时间戳），无凭证读取。
[ok] 是否创建后台任务/定时任务/Hook — 原文明确"不创建后台任务、定时任务或 Agent Hook。"
[ok] 失败路径与网络依赖处理 — SKILL.md 要求按退出状态确认，失败时一句话说明原因与下一步，并要求不贴完整终端日志。

6Verdict & Scenarios

Extremely low maintenance cost: a single npx command completes full official Skill synchronization, clarifying triggers, scope, and response formats within 55 lines.

Controlled scope: the target repository is hardcoded, explicitly avoiding npx skills update which could unintentionally overwrite other Skills.

Minimal and reclaimable local state: writes only a timestamp, creating no background tasks, cron jobs, or hooks.

No false-positive triggers: the authorization semantics of `1` are strictly bound to the prior update notification, ignoring digits if context is missing.

Closed loop with the ecosystem: notifications originate from /dbs's check-update.sh (UPDATE.json + 24h cache), and version consistency is strictly validated by repo toolchains.

Best for: Suitable for users who have installed dbskill and want to sync all 32 official business Skills to the latest release; also suitable for performing one-click upgrades after receiving a "reply 1" notification, or maintaining skills without impacting other third-party Skills.

Not for: Not suitable for managing or upgrading non-official Skills (the skill explicitly updates official repos only); not suitable for users who want to retain local customizations without backups; not suitable for offline environments or environments with restricted npm permissions (failures only state the reason without offline alternatives).

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload dbs-update.tar.gz

sha256: 7d66b91d94084816…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit 8b8e33f1ec.