{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "dbs",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local script or command: bash <skill_directory>/scripts/check-update.sh \"2.18.40\" (executed every time this skill is invoked)"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: GET https://raw.githubusercontent.com/dontbesilent2025/dbskill/main/UPDATE."
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: mkdir -p ~/.dbs and writes to ~/.dbs/update_check_at (overwriting with current unix timestamp)"
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查：① 不依赖第一遍笔记，直接读 dbs/SKILL.md 全文与 scripts/ 两个文件的每一行，核对「脚本真实存在且行为与 SKILL.md 描述一致」；② 用 grep 扫 URL/凭证/写入 token（curl|wget|http|API_KEY|token|secret|\\.env|>>|> ) 逐条落点，确认网络只有 UPDATE.json 一处、写入只有 ~/.dbs/update_check_at 一处；③ 反查夸大：SKILL.md 说「脚本失败时…停不下编排」是否属实——读 check-update.sh 的每个失败分支是否 exit 0；④ 交叉核对 .claude-plugin/marketplace.json 的 dbs 条目描述与 SKILL.md 的职责声明、references/official-skill-names.txt 与脚本排除规则（跳过 dbs 自身、含 beta/private 的名字）；⑤ 用 GitHub API 复核 stars/last_push/license，并核对本地 HEAD == 任务 pin commit。",
    "second_pass": [
      {
        "item": "两个脚本真实存在且可执行语义与描述一致",
        "status": "ok",
        "detail": "skills/dbs/scripts/check-update.sh（116 行 bash）与 skills/dbs/scripts/list-official-skills.py（python3）均逐行读过；SKILL.md 对二者行为的描述（24h 缓存、marketplace 优先、快照兜底、只返回已安装正式 Skill）与实现一致，无夸大。"
      },
      {
        "item": "网络外发唯一且为官方端点",
        "status": "ok",
        "detail": "全目录 token 扫描只命中一处 curl，指向 raw.githubusercontent.com/dontbesilent2025/dbskill/main/UPDATE.json；无 webhook、无上报、无第三方域名。"
      },
      {
        "item": "凭证读取为零",
        "status": "ok",
        "detail": "脚本只读 $HOME 路径与可选 DBS_UPDATE_URL；无 token/api_key/keychain/.env/.netrc 读取。"
      },
      {
        "item": "写文件范围（仅 ~/.dbs 缓存）",
        "status": "ok",
        "detail": "check-update.sh 中唯一写入是 mkdir -p \"$DBS_DIR\" 与 printf 时间戳到 ~/.dbs/update_check_at；list-official-skills.py 无 write 调用（只 read_text/print）。"
      },
      {
        "item": "远端 notice 文本会进入模型上下文（注入面）",
        "status": "ok（确认为设计内行为）",
        "detail": "SKILL.md 明确要求「命令有输出时，将输出内容追加在本次回复的最末尾，单独成段，引用格式为 > 🔔 {输出内容}」；notice 由脚本做 1–80 字与禁换行校验，非任意长文本。已按「远端可控字符串入上下文」如实计入 injection_surface。"
      },
      {
        "item": "版本号硬编码 2.18.40 与仓库 VERSION 一致",
        "status": "ok",
        "detail": "SKILL.md 的 DBS_LOCAL_VERSION=\"2.18.40\" 与仓库根 VERSION 文件（2.18.40）、UPDATE.json.version（2.18.40）三处一致。"
      },
      {
        "item": "「编排不自动扩权」是否只是口号",
        "status": "ok",
        "detail": "SKILL.md 有可执行的落地条款：任一成员需要新增授权时把授权条件写进提示词、本入口不代替用户授权；组合条件第 4 条要求「组合不会绕过任何成员的证据、权限、安全或停止边界」。属提示层约束（无代码级强制），已在 risks 中说明。"
      },
      {
        "item": "元数据（license/stars/last_push/installs）",
        "status": "ok",
        "detail": "GitHub API：stargazers_count 10121、pushed_at 2026-09-07T03:48:59Z、license.spdx_id NOASSERTION（仓库根 LICENSE 实为 CC BY-NC 4.0，非商业）；skills.sh 徽标 579.6K 为仓库级聚合。本地 git HEAD = 8b8e33f1ecaed8cee606fe950c4426b525ead314，与任务 pin 一致。"
      },
      {
        "item": "meta.installs 值域校正（批4 质检 2026-09-15）",
        "status": "discrepancy",
        "detail": "原记录为 skills.sh 仓库级聚合徽标（579.6K（skills.sh 徽标 /b/dontbesilent2025/…），并非本 skill 的单体安装量；站内惯例只记可定位的单 skill 数值 → 校正为 null（其他 25 份 dbs 报告本就为 null，修此 8 份以齐平）"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314",
    "sha256": "ab141ef415ad29ecd83cc34adaaa14330d350997d6be5884ad70325d6c5dbf27",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/dbs.tar.gz",
    "sha256": "ab141ef415ad29ecd83cc34adaaa14330d350997d6be5884ad70325d6c5dbf27",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  },
  "original": {
    "github": "https://github.com/dontbesilent2025/dbskill/tree/main/skills/dbs",
    "path": "skills/dbs",
    "commit": "8b8e33f1ecaed8cee606fe950c4426b525ead314"
  }
}