dbs-restore
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's shared technical specification in
references/archive-contract.mdinstructs the agent to execute a shell command usingpython3 -cto generate localized ISO 8601 timestamps for archive metadata. - [INDIRECT_PROMPT_INJECTION]: The skill functions by reading diagnostic archives from the local filesystem, creating a surface where untrusted data could influence agent transitions or context.
- Ingestion points: The agent reads Markdown files from
{archive_root}/sessions/and configuration from.dbs/config.json(as described inSKILL.mdandreferences/archive-contract.md). - Boundary markers: While the skill uses structured YAML frontmatter and Markdown headers to organize data, it does not employ specific 'ignore instructions' delimiters or boundary guards when passing this content to other skills.
- Capability inventory: The skill has the ability to read arbitrary files within its designated archive root and can trigger transitions to other skills based on the
next_skillfield found in the archive metadata. - Sanitization: The skill extracts core fields but lacks explicit sanitization or escaping mechanisms for the text content retrieved from archives before it is displayed to the user or used as a prompt context for subsequent skills.
Audit Metadata