Skip to content
skillsafebeta
← Report library
Purpose / Other

Dbs Restore Skill Security Audit

What the author says it does (original text)

恢复由 dbs-save 保存的最近诊断状态。用户要求接着上次、查看此前结论或继续未完成诊断时使用。

Independent security check

Do not install or run it yet

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Other project names and activity dates are automatically disclosed when the current project has no archive

Source references: 2
What we found

After restoration for the current project fails, the Skill scans other projects in the same archive location and directly lists the three most recent names and dates without an explicit request for cross-project discovery.

Why this matters

Project names may contain client names, product codenames, or private topics, which could enter the current chat transcript or be exposed to someone viewing the screen.

When the current project has no archive, the Skill proactively checks other projects under the same archive root and displays the three most recent names and activity dates. Names may reveal clients, work, or health topics, which can exceed a request to restore only the current project if the conversation is observed, shared, or logged. The scan is confined to the configured archive root, not the whole disk. Users can ask that consent be obtained first or that the Skill report only that other projects exist without naming them.

SKILL.md:74In the instructionsOpen original file
**情况 A：当前项目目录不存在或为空**先看 `{存档根目录}/sessions/` 下有没有别的项目。- 如果有别的项目 → 列出最近活跃过的 3 个（按各项目下最新存档的时间戳排序），让用户选：
Show 1 other places
SKILL.md:80In the instructionsOpen original file
```当前位置 `{项目名}` 没有诊断记录。最近你在以下项目里做过诊断：1. dontbesilent-shangye（最近 2026-04-22）2. xiaohongshu-test（最近 2026-04-15）3. paid-course（最近 2026-03-30）输入 `/dbs-restore --slug <名字>` 拉对应项目的记录。```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

A modifiable archive can control downstream Skill routing and inject its context

Source references: 3
What we found

Project configuration can redirect reads to a custom directory. The restore process reads the complete Markdown and tries to use available information even when its format is invalid. After the user merely says to proceed, it trusts the archive's `next_skill` and supplies archive content to that Skill. No source verification, allowed-Skill restriction, or instruction to treat archive text strictly as non-executable data is specified.

Why this matters

If repository configuration or an archive is preloaded, synchronized, or modified by another party, that party could change which Skill runs next and place manipulative instructions in its context. The actual consequence depends on the target Skill's permissions and could affect the user's files, accounts, credentials, or decisions.

The risk applies when an archive was manually modified or an untrusted archive exists in a custom root. The Skill is told to use available content despite format errors; after the user merely agrees to proceed, the archive’s next_skill and core content are passed to another Skill. That consent authorizes continuation, but there is no allowlist for next_skill or requirement that downstream Skills treat archive text only as data, so malicious content could influence tool selection or later decisions. Users can ask for an allowlist, provenance checks, and filtering of instruction-like archive text.

SKILL.md:46In the instructionsOpen original file
先读取当前工作目录下的 `.dbs/config.json`，并与 dbs-save 使用同一套解析规则：1. 配置文件不存在，或 `mode` 是 `default` → `~/.dbs/`2. `mode` 是 `project` → 当前工作目录下的 `.dbs/`3. `mode` 是 `custom` → `root` 指定的目录；展开开头的 `~`，相对路径按当前工作目录解析配置无法解析、`mode` 不受支持、`root` 为空，或路径指向 `/`、用户家目录、当前项目根目录时，停止恢复并说明配置问题。不要到其他位置猜测，也不要静默退回默认位置。
Show 2 other places
SKILL.md:102In the instructionsOpen original file
### Step 3：读存档文件读完整 markdown，解析 frontmatter 字段。如果文件格式不对（比如 frontmatter 缺字段、被用户手动改过），尽量用现有信息呈现，不要因为格式错误就拒绝展示。
SKILL.md:147In the instructionsOpen original file
**A. 用户说「就接着上次确认的下一步走」/「按那个走」**→ 这时候才路由到 next_skill 字段指的那个 skill。说一句：> 那走 `/{next_skill}`，把上次诊断的状态当输入。然后调用对应 skill。**调用时把存档的核心内容作为上下文喂给那个 skill**——不要让用户再讲一遍。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill reads a locally saved diagnostic archive and presents prior conclusions, rejected directions, pending hypotheses, and the next step; it states that it does not perform diagnosis itself.

View source
SKILL.md:8In the instructionsOpen original file
你是 dbskill 的状态恢复工具。你的工作是：从本地拉出最近一次保存的诊断存档，把状态呈现给用户，让他可以接着上次继续。**你不做诊断，不主动跳到别的 skill。** 你只负责把记忆拿回来。

The archive location can be selected by the project's `.dbs/config.json`, including the user's home directory, the project directory, or a custom directory; some overly broad target paths are rejected.

View source
SKILL.md:46In the instructionsOpen original file
先读取当前工作目录下的 `.dbs/config.json`，并与 dbs-save 使用同一套解析规则：1. 配置文件不存在，或 `mode` 是 `default` → `~/.dbs/`2. `mode` 是 `project` → 当前工作目录下的 `.dbs/`3. `mode` 是 `custom` → `root` 指定的目录；展开开头的 `~`，相对路径按当前工作目录解析配置无法解析、`mode` 不受支持、`root` 为空，或路径指向 `/`、用户家目录、当前项目根目录时，停止恢复并说明配置问题。不要到其他位置猜测，也不要静默退回默认位置。

If the current project has no archive, the Skill checks other projects under the same archive root and displays the names and activity dates of the three most recent projects.

View source
SKILL.md:74In the instructionsOpen original file
**情况 A：当前项目目录不存在或为空**先看 `{存档根目录}/sessions/` 下有没有别的项目。- 如果有别的项目 → 列出最近活跃过的 3 个（按各项目下最新存档的时间戳排序），让用户选：```当前位置 `{项目名}` 没有诊断记录。最近你在以下项目里做过诊断：1. dontbesilent-shangye（最近 2026-04-22）2. xiaohongshu-test（最近 2026-04-15）3. paid-course（最近 2026-03-30）输入 `/dbs-restore --slug <名字>` 拉对应项目的记录。```

After the user confirms that the archived next step should be followed, this Skill selects another Skill using the archive's `next_skill` field and passes the archive's core content to it.

View source
SKILL.md:147In the instructionsOpen original file
**A. 用户说「就接着上次确认的下一步走」/「按那个走」**→ 这时候才路由到 next_skill 字段指的那个 skill。说一句：> 那走 `/{next_skill}`，把上次诊断的状态当输入。然后调用对应 skill。**调用时把存档的核心内容作为上下文喂给那个 skill**——不要让用户再讲一遍。
Start here · InstructionsSKILL.md
dbs-restore
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
211
File checksum (to compare versions)
005c124ff8e045aeffd6b1bf8b9cfecbed4c40ff1491292cca7c17bcb7ae7df5