{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "dbs-update",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Execute local script or command: npx -y skills add dontbesilent2025/dbskill -g --all (the sole action specified in SKILL.md; executes official ecosystem"
    },
    {
      "file": "网络端点",
      "summary": "Declare external network access: npx pulls npm package skills and accesses GitHub to fetch dontbesilent2025/dbskill content (SKILL.md Step 1"
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: $HOME/.dbs/update_check_at (timestamp, used for internal caching)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 定界：本 skill 目录仅 SKILL.md 与 agents/openai.yaml（2 文件），全部行为集中在两条命令；② 命令逐字核对：npx 命令与时间戳命令均为源码原文；③ 关联机制溯源：为验证\"更新提醒 + 回复 1\"不是侦查推测，实读 skills/dbs/SKILL.md 与 skills/dbs/scripts/check-update.sh，确认提醒来自 UPDATE.json 远端版本比对、缓存文件正是 ~/.dbs/update_check_at（CACHE_TTL=86400），并逐字命中\"回复 1，我现在帮你更新。\"；④ 版本契约核对：读 tools/check-plugin-update-contract.py，确认 VERSION 与 marketplace/plugin 版本强一致；⑤ 反例寻找：核\"是否会自动更新其他 Skill\"——源码明确\"不使用 npx skills update，该命令可能更新用户安装的其他 Skill\"；⑥ 分级依据：目录内声明的动作为官方安装器的更新动作 + 本地时间戳写入 → 🟡（非 🟠：不外發用户素材、不读凭证；非 🟢：必然外發并写盘）。",
    "second_pass": [
      {
        "item": "目标仓库写死且唯一",
        "status": "ok",
        "detail": "SKILL.md 命令与\"更新范围\"节均只涉及 dontbesilent2025/dbskill，无参数化仓库输入。"
      },
      {
        "item": "\"不更新其他 Skill\"有显式反例约束",
        "status": "ok",
        "detail": "原文\"不使用 `npx skills update`，该命令可能更新用户安装的其他 Skill。\""
      },
      {
        "item": "\"回复 1\"的语义绑定上一轮提醒",
        "status": "ok",
        "detail": "SKILL.md 第二段与 skills/dbs/SKILL.md 都规定必须有上一条提醒上下文，否则不得解释数字含义。"
      },
      {
        "item": "时间戳缓存机制可回源",
        "status": "ok",
        "detail": "check-update.sh 定义 CACHE_FILE=\"$DBS_DIR/update_check_at\" 与 CACHE_TTL=86400，与 SKILL.md 的第 2 步配合。"
      },
      {
        "item": "更新日志/版本信息确实存在且为远端来源",
        "status": "ok",
        "detail": "仓库根 UPDATE.json（version 2.18.40 + notice）与 VERSION 文件存在；check-update.sh 默认从 raw.githubusercontent.com 读取。"
      },
      {
        "item": "是否读取用户凭证或存档内容",
        "status": "ok",
        "detail": "两条命令均不读取 ~/.dbs 内的存档/报告/决策记录（仅创建目录并写时间戳），无凭证读取。"
      },
      {
        "item": "是否创建后台任务/定时任务/Hook",
        "status": "ok",
        "detail": "原文明确\"不创建后台任务、定时任务或 Agent Hook。\""
      },
      {
        "item": "失败路径与网络依赖处理",
        "status": "ok",
        "detail": "SKILL.md 要求按退出状态确认，失败时一句话说明原因与下一步，并要求不贴完整终端日志。"
      },
      {
        "item": "覆盖本地修改官方 Skill 文件的行为细节",
        "status": "unlocatable",
        "detail": "SKILL.md 声明保留\"~/.dbs 存档\"和\"其他 Skill\"，但 npx skills add -g --all 对用户已改过的官方 Skill 文件是否覆盖，取决于安装器实现（不在本仓库源码内），无法定位。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314",
    "sha256": "7d66b91d94084816570e75707257138ec2e8de3af2310ec0943e8b4dedb98e48",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/dbs-update.tar.gz",
    "sha256": "7d66b91d94084816570e75707257138ec2e8de3af2310ec0943e8b4dedb98e48",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  },
  "original": {
    "github": "https://github.com/dontbesilent2025/dbskill/tree/main/skills/dbs-update",
    "path": "skills/dbs-update",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  }
}