Dbs Save Skill Security Audit

The Skill writes summaries of the user's words, customer quotes, and other diagnostic details to Markdown. It explicitly says archives are unencrypted local plaintext and may contain revenue, customer data, and trade secrets. Project mode places them in the project's `.dbs/`, which could leak if tracked by Git, while a custom root may be cloud-synced. Although it requires warnings and lets users adjust sensitive content, it does not require showing and confirming the exact sensitive fields before each write, so persistent storage and unintended synchronization are plausible risks.

The default project name is sanitized to `[a-z0-9-]`, but no equivalent validation or rejection rule is given for a user-supplied `--slug`. That value is then inserted directly into `sessions/{slug}/...`, with instructions to create missing directories. If the runtime treats `/` or `..` literally, files could be created outside the intended project subdirectory. No implementation script is shown, so this supports an instruction-level exploitable risk, not proof that traversal occurred. Users can ask the author to enforce the slug character set and verify the resolved path remains under the sessions root.

The Skill first reads `.dbs/config.json` from the current working directory and uses its `root` in custom mode; relative roots are resolved from that directory. It rejects a few especially broad targets but still permits other arbitrary writable locations. Its confirmation requirement explicitly applies when a user invokes `location ...` to create or update the configuration, not before consuming an existing repository-provided configuration. Thus, saving from a project with a preloaded config could write diagnostic data somewhere the user did not expect. Users can restrict it to ignore configurations not confirmed in the current conversation or request the read-only `location` operation first.